Temporal verification of reactive systems: progress

c Z. Manna and A. Pnueli, 28 Aug. 96. Not for Distribution Chapter 1: Response 1 Chapter 1 Response In the precedi...

Author: Manna Z. | Pnueli A.

15 downloads 672 Views 1MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!
Report copyright / DMCA form

DOWNLOAD PDF

c Z. Manna and A. Pnueli, 28 Aug. 96. Not for Distribution

Chapter 1: Response

1

Chapter 1

Response

In the preceding chapters we discussed methods for proving safety properties. While the class of safety properties is very important, and normally occupies a large portion of a speci cation, it must be complemented by properties in the other classes. It is interesting to note that the expression of safety properties and their veri cation use relatively little temporal logic. The main emphasis there is directed towards nding assertions that are invariant over the computation of a program. Most of the veri cation eorts are concentrated on showing that the assertions are inductive. This requires proving a set of veri cation conditions, which are expressed by nontemporal state formulas. Temporal logic is used mainly for stating the nal result of invariance of the assertion. It is true that, when considering precedence properties, we extensively use the past part of temporal logic. But as we commented there, an equivalent, though sometimes less elegant, state formulation of these properties can be managed through auxiliary or history variables. It is only when we enter the realm of more general properties, that temporal logic becomes an essential and irreplaceable tool. Thus if, for some reason, one is willing to restrict himself to the study of safety properties of reactive programs, he does not need the full power of temporal logic. A related observation is that, only when we go beyond safety properties does fairness become meaningful. Recall the de nition of a run as a state sequence that satis es the requirements of initiation and consecution but not necessarily any of the fairness requirements. It can be shown that a safety formula holds over all runs of a program if and only if it holds over all computations, i.e., fair runs. Thus, safety properties cannot distinguish between fair and unfair runs. This is no longer the case with progress (nonsafety) properties. Note, for example, that the in nite sequence s0 ; s0; : : : is a legal run of any program P, provided s0 . This run is generated by continuously taking the idling transition I . There are very few progress properties that hold over this run.

q

2


Chapter 1: Response

Consequently, while safety properties do not depend on the fairness requirements for their validity, progress properties do. In Chapters 1{3 we concentrate on the important class of response properties, which is one of the progress classes. This class contains properties that can be expressed by a formula of the form p, for a past formula p. In these chapters, we introduce a family of rules for response properties that rely on the dierent fairness requirements. Chapters 1{2 present rules that rely on justice , while Chapter 3 presents rules that rely on (justice and) compassion . Chapter 4 completes the picture by presenting rules for the highest progress class, that of reactivity. Chapter 1 deals with response properties that rely on the just transitions of the system for their validity. Chapter 3 generalizes the treatment to properties that rely on both justice and compassion for their validity. In Section 1.1 we consider a single-step rule that relies on the activation of a single just transition. Section 1.2 shows how to combine several applications of the single-step rule into a rule that relies on a xed number of activations of just transitions. Section 1.3 generalizes the rule to the case that the number of just activations necessary to achieve the goal is not xed and may depend, for example, on an input parameter. In Section 1.4, we extend all the above methods to prove properties expressed by response formulas that contain past subformulas. Section 1.5 deals with the class of guarantee formulas, treating them as a special case of response properties. In a similar way, Section 1.6 considers the class of obligation properties. Again, their veri cation is based on their consideration as a special case of the response class.

01

1.1 Response Rule Even though there are several dierent classes of progress properties, their veri cation is almost always based on the establishment of a single construct | the response formula

1

p ) q, for past formulas p and q. This formula states that any position in the computation which satis es p must be followed by a later position which satis es q. Since


1.1 Response Rule

01

1

3

1

the canonical response formula q is equivalent to T ) q, it follows that every response property can be expressed by a formula of the form p ) q. A general response property allows p and q to be general past formulas. In Sections 1.1{1.3 we consider the simpler case that p and q are assertions. In Section 1.4 we will generalize the treatment to the case that p and q are past formulas.

A Single-Step Rule A single-step rule, relying on justice, is provided by rule RESP-J presented in Fig. 1.1. For assertions p, q, ', and transition h 2 J , J1. p ! q _ ' J2. f'g T fq _ 'g J3. f'g h fqg J4. ' ! En (h ) p )

1

q

Fig. 1.1. Rule RESP-J (single-step response under justice). The rule calls for the identi cation of an intermediate assertion ' and a just transition h 2 J , to which we refer as the helpful transition . Premise J1 of the rule states that, in any position satisfying p, either the goal formula q already holds, or the intermediate formula ', bridging the passage from p to q, holds. The q-disjunct of this premise covers the case that the distance between the p-position and the q-position is 0. The '-disjunct and the other premises cover the case that the distance between these two positions is positive. Premise J2 requires that every transition leads from a '-position to a position that satis es q _ '. That is, either a position satisfying the goal formula q is attained or, if not, then at least the intermediate ' is maintained. Premise J3 requires that the helpful transition h always leads from a 'position to a q-position. Premise J4 requires that the helpful transition h is enabled at every 'position.

4


Chapter 1: Response

Justi cation To justify the rule, consider a computation which satis es the four premises of the rule. Assume that p holds at position k, k 0. We wish to show that q holds at some position i, i k. Assume, to the contrary, that it does not. That means that for all i, i k, q does not hold at i. By J1, ' holds at position k. By J2, every successor of a '-state is a (q _ ')-state. Since we assumed that q never occurs beyond k, it follows that ' holds continuously beyond k. By J4, the just transition h must be continuously enabled. However, h is never taken beyond k. This is because if h were taken, it would have been taken from a '-position, and by J3 the next position would have satis ed q. Thus we have that h is continuously enabled, but never taken beyond k. It follows that the sequence is not just with respect to h , and is, therefore, not a computation. This shows that, for all computations, there must exist an i, i k such that q holds at i. In applications of the rule, it is sucient to establish premise J2 for all 6= h , since J2 for = h is implied by J3. It is also unnecessary to check premise J2 for = I , the idling transition, since f'g I f'g is trivially state valid.

Example (program ANY-Y)

Program ANY-Y of Fig. 1.2 illustrates a simple program consisting of two processes communicating by the shared variable x, initially set to 0. Process P1 keeps incrementing variable y as long as x = 0. Process P2 has only one statement, which sets x to 1. Obviously, once x is set to 1, process P2 terminates, and some time later so does P1, as soon as it observes that x 6= 0.

local x; y: integer where x = y = 0

3 2 `0 : while x = 0 do P1 :: 64 `1 : y := y + 1 75 `2 :

P2 ::

m0: x := 1 m1 :

Fig. 1.2. Program ANY-Y.

1

We illustrate the use of rule RESP-J for proving the response property at m0 ) (x = 1) for program ANY-Y.


1.1 Response Rule

5

As the helpful transition h we take m0 . As the intermediate assertion ' we take p: at m0 . Premise J1 assumes the form _ at | {zm0} ; |at {zm0} ! |{z} q

p

'

which is obviously valid. Premise J2 is established by showing that all transitions, excluding m0 , preserve ': at m0 , which is clearly the case. Premise J3 requires showing that m0 leads from any '-state to a q-state, expressed by ! |x0 {z= 1} ; | ^{zx0 = 1} ^ |{z} m0

'

q

0

which is obviously valid. Finally, J4 requires |at {zm0} ! at| {zm0} ; '

1

En (m0 )

which is also valid. This establishes that the property speci ed by the response formula at m0 ) (x = 1) is valid over program ANY-Y.

Combining Response Properties Rule RESP-J by itself is not a very strong rule, and is sucient only for proving onestep response properties, i.e., properties that can be achieved by a single activation

of a helpful transition. For example, while program ANY-Y always terminates, its termination cannot be proven by a single aplication of rule RESP-J . In general, most response properties of the form p ) q require several helpful steps in order to get from a p-position to a q-position. To establish such properties we may use several rules that enable us to combine response properties, each established by a single application of rule RESP-J. These rules are based on general properties of response formulas that allow us to form these combinations. We list some of these properties as proof rules. All of these rules can be established as derived rules, using the standard deductive system for temporal logic1 .

1

Monotonicity

An important property of response formulas is the monotonicity of both the antecedent and the consequent. This can be summarized in the form of the (monotonicity) rule MON-R, presented in Fig. 1.3. 1 For example, the one presented in Chapter 3 of Volume I.

6


Chapter 1: Response

p ) q

1 )1

q )

r

p

t

r ) t

Fig. 1.3. Rule MON-R (monotonicity of response)

Rule MON-R enables us to strengthen the antecedent and weaken the consequent. Thus, if we managed to prove the response formula at `0 ) (x = 1), we can infer from it, using rule MON-R, the formula at `0 ) (x > 0).

Re exivity

1 1

Property RFLX-R of Fig. 1.4 states that the p )

1

1

operator is re exive. p

Fig. 1.4. Property RFLX-R (re exivity of response)

1

We may use this property to prove simple response formulas such as x = 0 ) (x = 0).

Transitivity

The transitivity property of response formulas is expressed by the (transitivity) rule TRNS-R, presented in Fig. 1.5. p )

1

q

p )

q )

1

r

1

r

Fig. 1.5. Rule TRNS-R (transitivity of response)


1.1 Response Rule

7

11 1

Thus, if we managed to prove for program ANY-Y the two response formulas at `1 ^ at m1 ^ x = 1 ) (at `0 ^ at m1 ^ x = 1) at `0 ^ at m1 ^ x = 1 ) (at `2 ^ at m1 ); we may use rule TRNS-R to conclude at `1 ^ at m1 ^ x = 1 ) (at `2 ^ at m1 ): The soundness of rule TRNS-R is obvious. Consider a computation such that the rst two premises are valid over . Let i be a position satisfying p. By the rst premise, there exists a position j, j i, satisfying q. By the second premise, there exists a position k, k j, satisfying r. Thus, we are ensured of a position k, k i, satisfying r, which establishes p ) r.

1

Proof by Cases

Another useful property of response formulas is that it is amenable to proof by cases. This possibility is presented by rule CASES-R of Fig. 1.6. p )

1

r

q )

(p _ q) )

1

1

r

r

Fig. 1.6. Rule CASES-R (case analysis for response) Assume, for example, that we have proved for program ANY-Y the two following reponse formulas. at `0 ^ at m1 ^ x = 1 ) (at `2 ^ at m1 ) at `1 ^ at m1 ^ x = 1 ) (at `2 ^ at m1 ). Then, we may use rule CASES-R to conclude

11

1

(at `0 ^ at m1 ^ x = 1) _ (at `1 ^ at m1 ^ x = 1) ) (at `2 ^ at m1 ), from which, by rule MON-R, we can infer at `0;1 ^ at m1 ^ x = 1 )


1

(at `2 ^ at m1 ):

We will illustrate the use of these rules by proving termination of program ANY-Y. This property can be expressed by the response formula

8


where

Chapter 1: Response

)

1

(at `2 ^ at m1 );

: = f`0 ; m0 g ^ x = 0 ^ y = 0 is the initial condition of program ANY-Y. The proof consists of the following steps:

1 1 ) 1 ) 1

1. at `0 ^ at m0 ^ x = 0 ) (at `0;1 ^ at m1 ^ x = 1) by rule RESP-J, taking h : m0 and ': at `0;1 ^ at m0 ^ x = 0 2. at `0 ^ at m1 ^ x = 1 ) (at `2 ^ at m1 ) by rule RESP-J, taking h : `0 and ': at `0 ^ at m1 ^ x = 1 3. at `1 ^ at m1 ^ x = 1 (at `0 ^ at m1 ^ x = 1) by rule RESP-J, taking h : `1 and ': at `1 ^ at m1 ^ x = 1 4. at `1 ^ at m1 ^ x = 1 (at `2 ^ at m1 ) by rule TRNS-R, applied to 3 and 2

1

5. (at `0 ^ at m1 ^ x = 1) _ (at `1 ^ at m1 ^ x = 1) ) (at `2 ^ at m1 ) by rule CASES-R, applied to 2 and 4 6. at `0;1 ^ at m1 ^ x = 1 ! (at `0 ^ at m1 ^ x = 1) _ (at `1 ^ at m1 ^ x = 1) an assertional validity 7. at `0;1 ^ at m1 ^ x = 1 ) 8. at `0 ^ at m0 ^ x = 0 )

1

1

(at `2 ^ at m1 ) by rule MON-R, using 5 and 6

(at `2 ^ at m1 ) by rule TRNS-R, applied to 1 and 7 9. ! at `0 ^ at m0 ^ x = 0 an assertional validity 10. ) (at `2 ^ at m1 ) by rule MON-R, applied to 8 and 9.

1

1.2 Chain Rule The proof of the last example follows a very speci c pattern that occurs often in proofs of response properties. According to this pattern, to establish p ) q, we identify a sequence of intermediate situations described by assertions 'm ; 'm 1 ; : : :; '0 such that p implies one of 'm ; : : :; '0, and q is identical with

1


1.2 Chain Rule

9

'0 (or is implied by '0 ). We then show that for every i > 0, being at 'i implies that eventually we must reach 'j for some j < i. We can interpret the index i of the intermediate formula 'i as a measure of the distance of the current state from a state that satis es the goal q. Thus, the lower the index, the closer we are to achieving the goal q. For a position j, let 'i be the intermediate formula with the smallest i s.t. 'i holds at j. We refer to the index i as the rank of position j. This proof pattern is summarized in rule CHAIN-J (Fig. 1.7). For assertions p and q = '0 ; '1; : : :; 'm and transitions 1 ; : : :; m 2 J J1. p !

m _ j =0

'j

_ 9 'j > > > j i = _ > J3. f'i g i 'j > for i = 1; : : :; m > j ; J4. ' ! En ( )

J2. f'i g T

i

p )

1

i

q

Fig. 1.7. Rule CHAIN-J (chain rule under justice). According to premise J1, p implies that one of the intermediate formulas 'i (possibly '0 implying q) holds. Premise J2 requires that taking any transition from a 'i -position results in a next position which satis es 'j , for some j i. Premise J3 requires that taking the helpful transition i from a 'i -position results in a next position which satis es 'j for j < i. We can view premise J2 as stating that the rank never increases, while premise J3 states that the helpful transition guarantees that the rank decreases. Premise J4 claims that the helpful transition i is enabled at every 'i -position.

Justi cation Assume that all four premises are P-state valid. Consider a P-computation and a position t that satis es p. We wish to prove that some

10


Chapter 1: Response

later position satis es q. Assume to the contrary that all positions later than t (including t itself) do not satisfy q. By J1, position t satis es 'j for some j 0. Index j cannot be 0 because '0 = q and we assumed that no position beyond t satis es q. Thus, position t satis es 'j , for some j > 0. By J2, position t + 1 satis es some 'k , k j. Again, k > 0 due to '0 = q. Continuing in this manner, it follows that every position beyond t satis es some 'j for j > 0, to which we refer as the rank of the position. By J2, the rank of the position can either decrease or remain the same. It follows that there must exist some position k t, beyond which the rank never decreases. Assume that i is the rank of the state at position k. Since q is never satis ed and the rank never decreases beyond position k, it follows (by J2) that 'i holds continually beyond k. By J3, i cannot be taken beyond k, because that would have led to a rank decrease. By J4, i is continually enabled beyond k yet, by the argument above, it is never taken. This violates the requirement of justice for i . It follows that if all the premises of the rule are P-state valid then the conclusion p ) q is P-valid.

1

Note that since premise J3 implies premise J2 for = i , it is sucient to check premise J2 for a given i = 1; : : :; m, only for 6= i . Also, it is unnecessary to check premise J2 for = I , since f'i g I f'i g trivially holds.

Example (Reproving termination of program ANY-Y)

Let us show how termination of program ANY-Y can be proved (again) by a single application of rule CHAIN-J. The property we wish to prove is |at `0 ^ at m0 {z^ x = 0 ^ y = 0} ) at| `2 ^{z at m1} : p=

1

q

Inspired by our previous proof of this property, we choose four assertions and corresponding helpful transitions as follows: '3: at `0;1 ^ at m0 ^ x = 0 3 : m0 '2: at `1 ^ at m1 ^ x = 1 2 : `1 '1: at `0 ^ at m1 ^ x = 1 1 : `0 '0 = q: at `2 ^ at m1 : Let us consider each of the premises of rule CHAIN-J. Premise J1 This premise calls for proving


1.2 Chain Rule

p !

_3 j =0

11

'j .

We will prove p ! '3 , which amounts to |at `0 ^ at m0 {z^ x = 0 ^ y = 0} ! at `0;1 ^ at m0 ^ x = 0

{z

|

p

}

'3

which obviously holds. Premises J2{J4 for i = 3; 2; 1 We list below the premises that are proven for each i, i = 3; 2; 1. Assertion '3 : at `0;1 ^ at m0 ^ x = 0 n o n o at `0;1 ^ at m0 ^ x = 0 at `0;1 ^ at m0 ^ x = 0

|

{z

|

}

'3

{z

'3

}

for each 6= m0

8at ` ^ at m ^ x = 1 > 1 {z 1 } > > ;

En (m0 )

'2

n

_9 > >

o

i

`1

n

for every 6= `1

at | `0 ^ at {zm1 ^ x = 1}

o

'1

! at | {z`1} : En (`1 )

Assertion '1 : at `0 ^ at m1 ^ x = 1 o n o at ` ^ at m ^ x = 1 at ` ^ at m ^ x = 1 0 1 0 1 | | {z } {z } '1

'1

for every 6= `0

12


Chapter 1: Response

n

at | `0 ^ at {zm1 ^ x = 1}

at | `0 ^

'1 at {zm1 '1

o

`0

n

|at `2 ^{z at m1}

^ x = 1} ! at | {z`0} :

o

'0

En (`0 )

All of these implications and veri cation conditions are obviously state valid, which establishes the conclusion ) (at `2 ^ at m1 ).

1

Relation to rule NWAIT There is a strong resemblance between the premises of rule CHAIN-J and those of rule NWAIT (Fig. 3.6 on page 267 of the SAFETY book). This is not surprising, since in both cases we wish to establish the evolution from p to q (q0 in the case of NWAIT) by successively passing through 'm ; 'm 1 ; : : :; '1; '0 . The main dierence is that, in rule NWAIT, we are quite satis ed if, from a certain point on, we stay forever within 'j for some j > 0. This is unacceptable in a response rule, where we are anxious to establish eventual arrival at '0 . This dierence is expressed in premise J3 which requires that activation of the helpful transition i takes us out of a 'i -state, and premise J4 which requires that i is enabled on all 'i -states. These premises have no counterparts in rule NWAIT. This excludes computations that consist of states whose rank, from a certain point on, never decreases below some j > 0. Another dierence is that, in rule NWAIT, we allow a transition _ to lead from 'i , i > 0, back to 'i . This is expressed by the disjunction, 'j , appearing in j i

the postcondition of premise N3. Rule CHAIN-J allows this in premise J2 for all but the helpful transition, which is required in J3 to lead to a position with a strictly lower rank. In spite of these dierences, many of the approaches used in the study of precedence properties are also applicable to the analysis of response properties. One of these useful approaches is that of veri cation diagrams introduced in Section 3.3 of the SAFETY book.

1.3 Chain Diagrams As observed in the previous example (program ANY-Y), in many cases it suces to specify the intermediate assertions '0; '1 ; : : :; 'm and to identify the helpful transitions 1 ; : : :; m . The proofs of the actual veri cation conditions is a detail


1.3 Chain Diagrams

13

that can be left to skeptical readers, and eventually to an automated system. Only some of the veri cation conditions raise interesting questions, and those are usually elaborated in a presentation of a proof. However, the main structure of the proof is adequately represented by the list of assertions and their corresponding helpful transitions. A concise visual summary of this information, and some additional details, is provided by veri cation diagrams. Veri cation diagrams were already introduced in Section 3.3 of the SAFETY book to represent proofs using rule NWAIT. However, we give here an independent description of the diagrams that support proofs of response properties by rule CHAIN-J.

Veri cation Diagrams

A veri cation diagram is a directed labeled graph constructed as follows: Nodes in the graph are labeled by assertions. We will often refer to a node by the assertion labeling it. Edges in the graph represent transitions between assertions. The diagrams presenting proofs by rule CHAIN-J allow edges of two types, represented graphically by single (-lined ) and double (-lined ) arrows. Each edge of either type departs from one assertion, connects to another, and is labeled by the name of a transition. We refer to an edge labeled by as a -edge . One of the nodes may be designated as a terminal node (\goal" node). In the graphical representation, this node is distinguished by having a boldface boundary. No edges depart from a terminal node. Terminal nodes correspond to \goal" assertions such as '0 in rule CHAIN-J.

Chain Diagrams

A veri cation diagram is said to be a chain diagram if its nodes are labeled by assertions '0 ; : : :; 'm, with '0 being the terminal node, and if it satis es the following requirements: If a single (-line) edge connects node 'i to node 'j , then i j. If a double (-line) edge connects node 'i to node 'j , then i > j. Every node 'i , i > 0, has a double edge departing from it. This identi es the transition labeling such an edge as helpful for assertion 'i . All helpful transitions must be just. The rst two requirements ensure that the diagram is weakly acyclic in the sense de ned in Section 3.3 of the SAFETY book for WAIT diagrams. That is, the terminal node is labeled by '0 and whenever node 'i is connected by an edge (single or double) to node 'j , then j i. The stronger second requirement ensures that the subgraph based on the double edges is acyclic, forbidding self-connections by

14


Chapter 1: Response

double edges. The third requirement demands that every nonterminal assertion (i.e., 'i for i > 0) has at least one helpful transition associated with it.

Veri cation Conditions for CHAIN Diagrams

The assertions labeling nodes in a diagram are intended to represent the intermediate assertions appearing in a CHAIN-J proof. A -labeled edge connecting node 'i to node 'j implies that it is possible for a 'i -state to have a -successor satisfying 'j . A double edge departing from node ' and labeled by transition identi es as helpful for assertion '. Consequently, we associate veri cation conditions with nodes and the edges departing from them. These conditions, expressed by implications, represent premises J2{J4 of rule CHAIN-J. For a node 'i and transition , connecting 'i to 'j , we say that 'j is a -successor of 'i . Let ' be a nonterminal node and '1 ; : : :; 'k , k 0, be the -successors of '. V1. If all the edges connecting ' to its -successors are single (-lined), then we associate with ' and the veri cation condition f'g f' _ '1 _ _ 'k g. Transition , labeling only single edges, is identi ed as unhelpful for '. This condition, similar to premise J2, allows to lead from a '-state back to a '-state, recording no progress. The case of a transition that does not label any edges departing from ' is interpreted as though labels k = 0 single-lined edges departing from '. That is, with such a transition we associate the veri cation condition f'g f'g. V2. If some edge departing from ' is double (hence k > 0), we associate with ' and the veri cation condition f'g f'1 _ _ 'k g. This condition corresponds to premise J3, requiring a transition , identi ed as helpful, to lead away from '. V3. If labels some double edge departing from ', we require ' ! En (). This condition corresponds to premise J4, requiring that a transition helpful for ' is enabled on all '-states. We refer to this requirement as the enabling requirement .

Valid CHAIN Diagrams

A CHAIN diagram is said to be valid over a program P (P-valid for short) if all the veri cation conditions associated with nodes of the diagram are P-state valid.


1.3 Chain Diagrams

15

The consequences of having a P-valid CHAIN diagram are stated by the following claim:

Claim 1.1 (CHAIN diagrams)

A P-valid CHAIN diagram establishes that the response formula m _

j =0

'j )

1

'0

is P-valid. If, in addition, we can establish the P-state validity of the following implications: (J1) p !

1

m _

j =0

'j

and

(J0) '0 ! q

then, we can conclude the P-validity of p ) q.

Justi cation First, we show the rst part of the claim, stating the P-validity

of

m _

1

'j ) '0 . j =0 W ' , q = ' and, for each i = 1; : : :; m, we We use rule CHAIN-J with p: m 0 j =0 j take i (the helpful transition for 'i ) to be the transition labeling the double edge departing from 'i . For our choice of p and q, premise J1 of rule CHAIN-J assumes the form m m _ _ 'j , 'j ! (J1) j =0 j =0

which is trivially state-valid. We proceed to show that the P-state validity of premises J2{J4 follows from the P-validity of the diagram, for each i = 1; : : :; m. Premise J2 requires showing (J2) ^ 'i ! '00 _ '01 _ _ '0i , for each 2 T . Let 'i1 ; : : :; 'ik be the -successors of 'i in the P-valid diagram, for 2 T fi ; I g. By the requirement of weak acyclicity i1 i; : : :; ik i. Since 6= i , all the -edges departing from node ' are single-line edges and the following veri cation condition holds: V1. ^ 'i ! '0i _ '0i1 _ _ '0ik .

16


Chapter 1: Response

Since ij i for each j = 1; : : :; k, the disjunction on the right-hand side of V1 is taken over a subset of the assertions appearing on the right-hand side of premise J2. It follow that J2 is state-valid for assertion 'i and transition . For = I , premise J2 holds trivially since I implies '0i = 'i . For = i , premise J2 is implied by J3. Premise J3 requires (J3) i ^ 'i ! '00 _ '01 _ _ '0i 1 . Let 'i1 ; : : :; 'ik be the i -successors of 'i in the P-valid diagram. Since all i edges departing from 'i are double, ij < i for j = 1; : : :; k and the following veri cation condition holds: V2. ^ 'i ! '0i1 _ _ '0ik . Repeating the subset argument, this implies the state validity of premise J3. Premise J4 is identical to condition V3 for every 'i and i , i = 1; : : :; m. we consider the more general case of p and q which are not identical to Wm Next, ' and '0,Wrespectively, but satisfy the implications J1 and J0. Applying j =0 j rule MON-R to p, m j =0 'j , '0 , and q (standing for p, q, r, and t in MON-R), we obtain the conclusion p ) q.

1

Note that chain diagrams and their notion of validity are a conservative extension of the WAIT diagrams, introduced in Section 3.3 of the SAFETY book. The additional requirements that disallow a self-connecting edge all refer to double edges which are not present in WAIT diagrams. It follows that a P-valid CHAIN diagram is also P-valid for proving the nested waiting-for formula m _

j =0

'j ) 'm W 'm 1 '1 W '0 .


Consider again program ANY-Y (Fig. 1.2). The CHAIN diagram of Fig. 1.8 provides a graphical representation for the proof of the response property at ` ^ at m ^ x = 0 ) at ` ^ at m 0 0 2 1 | | {z } {z } ; p=

1

q='0

for program ANY-Y. The diagram identi es '3 ; : : :; '0 as the intermediate assertions and m0 ; `1; `0 as their corresponding helpful transitions. This CHAIN diagram is valid over program ANY-Y, which establishes the P-validity of


1.3 Chain Diagrams

' : at ` ^ at m ^ x = 0 m m ' : at ` ^ atm ^ x = 1 ` ' : at ` ^ atm ^ x = 1 ` ' : at ` ^ at m 0;1

3

17

0

0

0

2

1

1

1

1

0

1

0

0

2

1

Fig. 1.8. CHAIN diagram for termination.

_3 j =0

'j )

1

(at `2 ^ at m1 )

over this program. Since (as shown above) ! '3 , the second part of Claim 1.1 establishes the P-validity of the termination property ) (at `2 ^ at m1 ).

1

The Advantages of Diagrams

One of the advantages of the presentation of a CHAIN-J proof sketch by a CHAIN diagram, over its presentation by a list of assertions and their corresponding helpful transitions is that the diagram provides a stronger (and more detailed) version of premises J2 and J3 than is standardly provided by rule CHAIN-J and a list of the assertions and helpful transitions. Consider, for example, the proof presented in Fig. 1.8. Both the diagram and the textual proof identify '2 as at `1 ^ at m1 ^ x = 1 and `1 as its helpful transition. However, while rule CHAIN-J suggests that we prove for premise J3 the veri cation condition f'2g `1 f'0 _ '1 g, the diagram claims that the even stronger condition f'2g `1 f'1g

18


Chapter 1: Response

is P-state valid. This results from the fact that there is no `1 -edge connecting '2 to '0 .

Encapsulation Conventions

There are several encapsulation conventions that lead to more structured hierarchical diagrams and improve the readability and manageability of large complex diagrams. These conventions were introduced in Section 3.3 of the SAFETY book and we reproduce them here brie y, to make the presentation self contained. The basic construct of encapsulation is that of a compound node that may contain several internal nodes. The encapsulation conventions attribute to a compound node aspects and relations that are common to all of their contained nodes. We refer to the contained nodes as descendants of the compound node. Nodes that are not compound are called basic nodes . We use three encapsulation conventions.

Departing edges

An edge departing from a compound node is interpreted as though it departed from each of its descendants. This is represented by the graphical equivalence of Fig. 1.9.

F C

F C

2

2

' - ' E D 1

' j * ' E D 1

Fig. 1.9. Departing edges.

Arriving edges

In a similar way, an edge arriving at a compound node is interpreted as though it arrived at each of its descendants. This is represented in the graphical equivalence of Fig. 1.10.

Common factors

An assertion ' labeling a compound node is interpreted as though it were a conjunct added to each of the labels of its descendants. This is represented by the graphical equivalence of Fig. 1.11. We refer to ' as a common factor of the two nodes.


1.3 Chain Diagrams

F C 1

F1 C

2

2

19

' ' q E D E D 1

Fig. 1.10. Arriving edges.

FC 1

F C ^

2

2

'

ED

' ' ^ E

1

D

Fig. 1.11. Common factors.

Example In Fig. 1.12 we present a veri cation diagram which is the encapsu-

lated version of the veri cation diagram of Fig. 1.8. This encapsulation uses the arriving edge convention to denote by a single arrow the two edges connecting '3 to '2 and to '1 . It uses the common factor convention to simplify the presentation of '1 and '2 .

Additional Examples Let us consider a few more examples for the application of rule CHAIN-J and CHAIN diagrams, illustrating the encapsulation conventions.

Example (Peterson's Algorithm | version 1)

For the next example, we return to program MUX-PET1, Peterson's algorithm for mutual exclusion (Fig. 1.13). This program was previously studied in Section 1.4 of the SAFETY book, where we established for it the following invariants: 0: s = 1 _ s = 2 1: y1 $ at `3::5

20


' : at ` 3

Chapter 1: Response

0;1 ^ at m0 ^ x = 0

F C m0

at m1 ^ x = 1

' : at ` ` ' : at` ` E D 2

1

1

1

0

0

'0: at `2 ^ at m1

Fig. 1.12. Encapsulated version of CHAIN diagram for termination.

2: y2

$ at m3::5.

We wish to prove for this program the response property of accessibility, given by at | {z`2} ) at| {z`4} : p

1

q

To use rule CHAIN-J or its diagram representation, we have to identify intermediate assertions that characterize the intermediate situations between the starting assertion p: at `2 and the goal assertion q: at `4 . It is obvious that the rst helpful step in the progress from `2 to `4 is process P1 moving from `2 to `3 . Consequently, we can safely take 'm to be at `2 and the helpful transition m to be `2 . We cannot yet determine the value of m because it depends on the number of helpful steps necessary to get from `3 to `4 . We can now concentrate on showing how to get from `3 to `4 . Similar to the heuristics employed in the application of rule NWAIT (Section 3.3 of the SAFETY book), it is often useful to work backwards from the goal assertion at `4 . Consequently, we take '0 to be at `4 . For the previous intermediate assertion '1 , we look for situations that are only one helpful step away from '0 . Clearly, the only transition that can accomplish '0 in one step is `3 . If we choose the helpful transition 1 to be `3 , then


1.3 Chain Diagrams

21

local y1 ; y2 : boolean where y1 = y2 = F s : integer where s = 1

3 2` : loop forever do 0 377 66 2`1: noncritical 66 6` : (y ; s) := (T; 1) 777 1 77 P1 :: 66 66`2 : await :y2 _ s 6= 177777 66 66 3 575 4 4`4: critical `5 : y1 := F

3 2m : loop forever do 0 37 66 2m1 : noncritical 66 6m : (y ; s) := (T; 2) 7777 2 77 P2 :: 66 66m2 : await :y1 _ s 6= 277777 66 66 3 575 4 4m4 : critical m5 : y2 := F

Fig. 1.13. Program MUX-PET1 (Peterson's algorithm) | version 1.

the appropriate '1 is the assertion characterizing all the states on which `3 is enabled. Therefore, as '1 we take the enabling condition of `3 '1: at `3 ^ (:y2 _ s 6= 1). Assertion '1 does not yet cover all the accessible states satsifying at `3 . Consequently, we cannot take m to be 2, and must search for additional assertions, characterizing states that satisfy at `3 and that are one helpful step away from '1 . Therefore, we look for transitions of P2 that may change the disjunction :y2 _ s = 2 from F to T. The only candidate transition is m5 , which sets y2 to F. Consequently, we take '2: at `3 ^ at m5 ^ y2 ^ s = 1. The conjunct y2 ^ s = 1 can be safely added to '2 since all the states satisfying at `3 ^ (:y2 _ s 6= 1) are already covered by '1. Looking for (at `3 ^ y2 ^ s = 1)-states that are one helpful step away from '2 , we easily identify '3: at `3 ^ at m4 ^ y2 ^ s = 1.

22


Chapter 1: Response

In a similar way, we can identify the preceding assertion as '4: at `3 ^ at m3 ^ y2 ^ s = 1. Note that m3 , which is the helpful transition for '4 , is enabled on all states satisfying '4 . At this point, we nd out that the disjunction '1 _ _ '4 covers the range of all accessible (at `3 )-states. This is because P2 must be in one of the locations m0 ; : : :; m4 . Due to 2 , the range m0::2 is covered by '1 under the :y2 disjunct. Locations m3 : : :; m5 for s 6= 1 are covered by '1 under the disjunct s 6= 1, while the same locations for the case that s = 1 are covered by assertions '4; '3 ; '2, respectively. In Fig. 1.14 we present a CHAIN diagram using the intermediate assertions constructed through the preceding analysis. Note that we have grouped under '1 many possible states of P2, and have not represented the movement of P2 through them. This is justi ed by the fact that `3 is enabled on all of these states and is the transition declared as helpful for '1 . In contrast, we separated m3 , m4 , and m5 , because the helpful transitions there changed from one of these states to the next. In Problem 1.1, the reader is requested to establish accessibility for another algorithm for mutual exclusion.

Example (Peterson's Algorithm | Version 2)

Consider the re ned program MUX-PET2, version 2 of Peterson's algorithm, presented in Fig. 1.15. In Section 1.4 of the SAFETY book, we established the following invariants for this program: 0 : s = 1 _ s = 2 1: y1 $ at `3::6 2: y2 $ at m3::6. We intend to verify the property of accessibility for program MUX-PET2, which can be expressed by the response formula at | {z`2} ) at| {z`5} : p

1

q

The construction of the appropriate veri cation diagram starts in a similar way to the diagram for program MUX-PET1 of the previous example. We take 'm to be at `2 . From `2 , process P1 can proceed at its own pace to `3 , which we take as 'm 1 . The next step taken by P1 leads into `4 where a more detailed analysis is necessary.


1.3 Chain Diagrams

' : at ` ` 5

F

at `3 ; y1

23

2

2

F C E D : _ 6 y2 ; s = 1

C

'4 : at m3 m3 '3 : at m4 m4 '2 : at m5 m5

': E 1

y2

s=1

`3

D

'0: at `4

Fig. 1.14. CHAIN diagram for program MUX-PET1.

To perform this detailed analysis we take '0 to be the goal assertion at `5 . What should we take as '1 ? In the preceding case, we characterized '1 as being one helpful step away from '0 . This characterization is not sucient here. Another requirement is that if s0 is a successor of a '1 -state, then s0 should satisfy either '1 or '0 : at `5 . This shows that we cannot take '1 to be, as before, the assertion at `4 ^ (:y2 _ s 6= 1). This is because the accessible state

s: : f`4; m2 g; y1 : T; y2 : F; s: 1 satis es the candidate assertion at `4 ^ (:y2 _ s 6= 1) but has an m2 -successor

24


Chapter 1: Response

local y1 ; y2 : boolean where y1 = y2 = F s : integer where s = 1

2` : loop forever do 3 0 377 66 2`1: noncritical 66 6` : y := T 77777 66 66 2 1 7777 66 66`3: s2 := 1 377 à4 : await :y2 7777 P1 :: 66 66 777 66 66`4: 64 or 66 66 `b : await s 6= 15777777 4 7777 66 66 55 4 4`5: critical `6 : y1 := F

3 2m : loop forever do 0 377 66 2m1 : noncritical 66 6m : y := T 77777 66 66 2 2 7777 66 66m3 : 2s := 2 77 3 ma4 : await :y1 7777 P2 :: 66 666 757777 66 6m4 : 64 or 6 66 6 b : await s 6= 2 7 77777 m 4 6 66 6 7575 4 4m5 : critical m6 : y2 := F

Fig. 1.15. Program MUX-PET2 (Peterson's algorithm) | version 2.

given by

s0 : : f`4 ; m3g; y1 : T; y2 : T; s: 1 which satis es neither the candidate assertion nor '0. We observe that the cause for this problem is the disjunct :y2 which can be falsi ed (changed from T to F) by transition m2 of P2 . There is no such problem with the disjunct s 6= 1 which cannot be falsi ed by P2. Consequently, we take '1: at `4 ^ s 6= 1.


1.3 Chain Diagrams

25

The only transition that can lead from a :'1-state to a '1 -state is m3 . Therefore, we take '2 to be '2: at `4 ^ at m3 ^ s = 1. We also realize that the transition leading into '2 is m2 which changes y2 from F to T and preserves the value of s. Consequently, we take '3 to be '3: at m0::2 ^ :y2 ^ s = 1. By now, we have covered all the states satisfying at `4 ^ (:y2 _ s 6= 1). From now on, the analysis proceeds as it did for program MUX-PET1. The nal CHAIN diagram is presented in Fig. 1.16. This diagram partitions the range m0::4 into three regions. The region m0::2, represented by '3 , guarantees the enableness of à4 (but not the enableness of m2 which is therefore drawn as a single edge). However it may evolve into '2 , where no transition of P1 is guaranteed to be enabled. Being at '2, m3 is the helpful transition which eventually leads into '1. In '1 , `b4 is enabled, and since P2 cannot falsify s 6= 1, eventually `b4 is taken and leads to '0 . The edge labeled à4 connecting node '1 to node '0 represents the possibility that à4 may be enabled on a state satisfying s 6= 1. A more careful analysis shows that '1 in this diagram can be strenghened to the assertion 'b1: at m4 ^ s 6= 1 ^ y2 , and then this edge is unnecessary. In Problem 1.2, the reader is requested to verify accessibility for a family of mutual exclusion algorithms, known as the bakery algorithms .

Example (Dekker's algorithm)

Dekker's algorithm for solving the mutual exclusion problem is presented in program MUX-DEK of Fig. 1.17. In comparison to Peterson's algorithm, Dekker's algorithm has a relatively simple safety proof but rather elaborate proof of accessibility.

Invariants

In Section 1.4 of the SAFETY book we derived the following invariants for program MUX-DEK: 1 : t = 1 _ t = 2 2: y1 $ (at `3::5;8::10) 3: y2 $ (at m3::5;8::10) These are the invariants we needed to prove the mutual exclusion property, i.e., the invariance of

26


' : at ` ` ' : at` ` 8

Chapter 1: Response

2

2

F

at `4 ; y1

7

3

3

F C E D ^ : ^ y2 ; s = 1 '6 : at m4

C

mb4

'5 : at m5 m5 '4 : at m6 m6

à4

'3 : at m0::2

y2 s = 1

m2

' : at m?^ s = 1 m ' : s6= 1 ` ` D 2

3

3

E

a 4

1

b 4

'0 : at `5

Fig. 1.16. CHAIN diagram for program MUX-PET2.


1.3 Chain Diagrams

27

local y1 ; y2 : boolean where y1 = F; y2 = F t : integer where t = 1

2`0: loop forever do 3 377 66 2`1: noncritical 66 6`2: y1 := T 77777 66 66`3: while y2 do 7777 66 66 7777 66 66 `4: if t = 22 3 7777 `5 : y1 := F P1 :: 66 66 then 4`6: await t = 15777777 66 66 7777 66 66 `7 : y1 := T 6 7777 66 6`8: critical 6 7575 64 4`9: t := 2 `10 : y1 := F

3 2m : loop forever do 0 377 66 2m1 : noncritical 66 6m2 : y2 := T 77777 66 66m : while y do 7777 1 66 66 3 7777 66 66 m4: if t = 12 3 7777 m5 : y2 := F P2 :: 66 66 then 4m6 : await t = 25777777 66 66 7777 66 66 m7 : y2 := T 7777 6 66 6m8 : critical 7575 6 64 4m9 : t := 1 m10 : y2 := F

Fig. 1.17. Program MUX-DEK (Dekker's algorithm for mutual exclusion).

4: :(at `8::10 ^ at m8::10). As we will see, additional invariants are needed for the support of the response property. We will develop them as they are needed.

Response

28


Chapter 1: Response

The main response property of this algorithm is, of course, that of accessibility. It is stated by : at `2 ) at `8 . We partition the proof of the accessibility property into three lemmas, proving respectively.

1

Lemma A at `2 )

1

(at `4 ^ t = 2) _ (at `3::7 ^ t = 1) _ at `8

Lemma B at `4 ^ t = 2 ) Lemma C at `3::7 ^ t = 1 )

1

(at `3::7 ^ t = 1)

1

at `8 .

Obviously, the dicult part of the protocol is the loop at `3::7. Being within this loop, P1 is considered to have a higher priority when t = 1. Lemma A claims that if P1 is just starting its journey towards the critical section, then it will either reach `4 with a lower priority, or get to `3::7 with a higher priority, or reach `8 . Lemma B claims that if P1 is at `4 with a low priority it will stay within the loop and eventually gain a high priority. Lemma C shows that if P1 is within this loop and has a higher priority, then it will eventually get to `8 . Clearly, by combining these three response properties, using the transitivity of response rule TRNS-R we obtain the required accessibility property. Proof of Lemma A

1

The proof of the response property at `2 ) (at `4 ^ t = 2) _ (at `3::7 ^ t = 1) _ at `8 is presented in the CHAIN diagram of Fig. 1.18. It is easy to follow P1 from `2 to `3 . If t = 1 on entry to `3 , then we are already at the goal at `3::7 ^ t = 1. Otherwise, we enter `3 with t = 2, setting y1 to T. Here we examine the possible locations of P2. Assertions '1 , '2, and '3 cover all the possibilities. The possible motions of P2 within these three assertions consist of taking m9 , setting t to 1, which raises the priority of P1 and attains the goal at `3::7 ^ t = 1. The other possible movements are from '3 to '2, and then to '1 . Being at m3;4 with y1 = T and t = 2, P2 cannot move elsewhere. Transition mode `T3 is enabled on '1 and '3 states, while mode `F3 is enabled on '2 . Both are helpful since they lead to at `4 ^ t = 2 and at `8 , respectively. Proof of Lemma B

1

The proof of the response property at `4 ^ t = 2 ) (at `3::7 ^ t = 1)


1.3 Chain Diagrams

' : at ` ` ` 4

2

2

F C ^ 2

29

at `3 ; y1 ; t = 2

`T3

'3 : at m5;8::10 y2 m9 m5 ; m10

? ` ' : at m ^ :y m ;m ` ? ' : at m ^ y E D ' : ? at ` ^ t = 2 at ` at ` ^ t = 1

0::2;6;7

2

2

T 3

1

3;4

2

F 3

7

2

0

4

8

3::7

Fig. 1.18. CHAIN diagram for Lemma A.

is presented in the CHAIN diagram of Fig. 1.19. From `4 , P1 proceeds to `5 since t = 2, and then to `6 while resetting y1 to F. While being at `4;5, P2 may still set t to 1 by performing m9 , which leads to the goal at `3::7 ^ t = 1. However, once P1 enters `6 , it stays at `6 waiting for t to change to 1. At that point we have to inspect where P2 may currently be. We consider as possible locations of P2 all of m2 {m9 , tracing their possible ow under the relatively stable situation of t = 2, y1 = F. We see that all transitions are enabled and lead to m9 which eventually sets t to 1 as required. A tacit assumption made in this diagram is the exclusion of m10 , m0 , and m1 , as possible locations while P1 is at `6 with y1 = F and t = 2. This assumption must hold for the program, if we believe Lemma B to be valid. Indeed, consider the situation that P1 is waiting at `6 with y1 = F and t = 2, while P2 is at m1 .

30


Chapter 1: Response

F F C C E D F: C

E D E D -

^ t=2

y1

m9

'10 : at `4 `4 '9 : at `5 `5

at `6 ; y1

'5 : at m4 m4

'8 : at m5 m5

'6 : at m2 m2 '3 : at m3 m3

'7 : at m6 m6

m7 ' : at m 4 7

'2 : at m8 m8 '1 : at m9 m9

'0 : at `3::7

t=1

Fig. 1.19. CHAIN diagram for Lemma B.

Since P2 is allowed to stay at the noncritical section forever, this would lead to a deadlock, denying accessibility from P1. We must therefore conclude that if the algorithm is correct, and guarantees accessibility to both processes, then the following assertion must be invariant


1.3 Chain Diagrams

31

at `6 ^ t = 2 ! at m2::9.

This invariance follows from the stronger invariant 5: at `4::6 ^ t = 2 ! at m2::9 which we will prove. By symmetry one can also require the invariance of 6: at m4::6 ^ t = 1 ! at `2::9. Proof of invariant 5 hh Exercise? ii Clearly, | ^ at{z`0 ^ } ! |at `4::6 ^ t ={z2 ! at m2::9} 5 holds. Let us check the veri cation conditions for assertion 5 , which are of the form |at `0 ^ at m0 ^ {z:y1 ^ :y2 ^ t = 1} ^ at| `4::6 ^ t ={z2 ! at m2::9} ! 5 0 0 0 |at `4::6 ^ t ={z2 ! at m2::9} : 5 0

There are three transitions that may potentially falsify assertion 5. Transition m9 Sets t to 1 which makes t0 = 2 false and hence preserves the assertion. Transition `9 Leads to at `10 which makes at 0 `4::6 false. `T3 while t = 2 This is possible only if y2 = T which, by 3 , implies at m3::5 _ at m8::10, and therefore at m2::10. This almost gives us at m2::9, with the exception of m10 . We thus need additional information that will exclude the possibility of P2 being at m10 while t = 2. Clearly, while entering m10 from m9 , P2 sets t to 1. Can P1 change it back to 2, while P2 is still at m10 ? The answer is no, because m10 , as we see in 4 , is still a part of the critical section and is therefore exclusive of `9 , the only statement capable of changing t to 2. This suggests the invariant 7: at m10 ! t = 1

32


Chapter 1: Response

and its symmetric counterpart 8: at `10 ! t = 2. To prove 7 , we should inspect two transitions: Transition m9 Sets t to 1. `9 while at m10 Impossible due to 4 . This establishes 7 and similarly 8 . Having 7 we can use it to show that the last transition considered in the proof of 5, namely `T3 while t = 2, implies at m2::9, which establishes 5. Proof of Lemma C

Lemma C states that if P1 is within the waiting loop `3::7 with higher priority, i.e., t = 1, then eventually it will reach `8 . It is stated by at `3::7 ^ t = 1 ) at `8 . The proof is presented in the CHAIN diagram of Fig. 1.20. Note our eorts to minimize the number of assertions by grouping together situations with dierent control con gurations, wherever possible. Thus for all the states where y1 = T and P1 is either at `3 or at `4 , we do not distinguish between these two possibilities, but partition the diagram according to the location of P2. This is because, in this general situation, it is P2 which is the helpful process and we have to trace its progress. On the other hand, when y2 = F, P1 becomes the helpful process and we start distinguishing between the cases of at `3 and at `4 , while lumping together the locations of P2 into two groups: m0::2;7 and m6 . These two groups must be distinguished because it is possible (though not guaranteed) to exit the rst group into a situation where y2 = T, but it is impossible to exit m6 into such a situation. This is because when P2 is at m6 with t = 1, it cannot progress until t is changed to 2.

1

In Problem 1.3, the reader is requested to prove accessibility for two variants of Dekker's algorithm.

Case Splitting According to the Helpful Transitions In the preceding examples, the main reason for using rule CHAIN-J with m > 1 intermediate assertions has been that the program requires m helpful steps to reach the goal. In most of these applications there always was a worst case computation that actually visited each of the assertions, starting with 'm and proceeding through 'm 1 ; 'm 2 ; : : : up to '0 = q.


1.3 Chain Diagrams

F

t=1

' : at ` ` ' : at ` ` ' : at ` ` 13

F F E F : E F ? E F: E E E

5

5

12

6

6

' : at m m

'10: at m8 m8

9

9

9

' : at ` `

at m0::2;7; y2

7

4

4

m2 ; m7

y2

' : at m m

'5: at m3 m3

at m6 ; y2

7

7

at `3;4; y1

y2

11

4

4

4

' : at ` ` 2

4

4

33

C

C

C D C D C D C D DD

'8 : at m10 m10

'6 : at `3 `3

'3 : at m5 m5

'1 : at `3 `3

'0 : at `8

Fig. 1.20. CHAIN diagram for Lemma C.

34


Chapter 1: Response

This is not the only motivation for using several intermediate assertions. Another good reason for wishing to partition the state space lying between p and q into several assertions is that dierent states in that space may require dierent helpful transitions for getting them closer to the goal.

Example (maximum)

Consider, for example, program MAX presented in Fig. 1.21. This program places in output variable z the maximum of inputs x and y. The program consists of two parallel statements that compare the values of x and y.

in x; y: integer out z : integer

2` : if x y then3 0 4 `1 : z := x 5 `2 :

2 3 m0 : if x y then 4 m1 : z := y 5 m2 :

Fig. 1.21. Program MAX (maximum).

1

The response statement we would like to prove for this program is |at `0 ^{z at m0} ) |maximal{z(z; x; y)} ; p

q

where maximal (z; x; y) stands for the formula maximal (z; x; y): (z = x _ z = y) ^ z x ^ z y, claiming that z is the maximum of x and y. Clearly, the goal of this response property is achieved in the helpful steps which are either `0 and `1 or m0 and m1 . Perhaps one would expect a proof of this property by rule RESP-J that only uses one intermediate assertion '. However, no such proof exists. The reason for this is that we cannot identify a single transition that is helpful for all the states satisfying p: at `0 ^ at m0 . Clearly, for all states satisfying p ^ x y, `0 is the helpful transition, while for states satisfying p ^ x y, m0 is the helpful transition. Consequently, we need at least four intermediate assertions in a proof of this property by rule CHAIN-J. We choose the following assertions and helpful transitions '4: at m0 ^ x y 4 : m0 '3: at `0 ^ x y 3 : `0


1.4 Well-Founded Rule

35

'2: at m1 ^ x y 2 : m1 '1: at `1 ^ x y 1 : `1 '0: q: It is straightforward to verify that all the premises of rule CHAIN-J are satis ed by this choice. In Fig. 1.22, we present a CHAIN diagram for the proof of the considered response property.

F C

xy

' : at ` ` ' : at` E ` D 3

0

0

1

1

1

F C

xy

' : at m m ' : at m E m D

'0 : maximal (z; x; y)

4

0

0

2

1

1

Fig. 1.22. CHAIN diagram for program MAX. Assertions '3 and '4 partition (non-exclusively) the situation at `0 ^ at m0 into states for which `0 is helpful and has not been taken yet, and states for which m0 is helpful and has not been taken yet. It is not dicult to verify that taking `0 from a '3 -state, as well as taking m0 from a '4 -state, leads to '1 and '2 , respectively. Choosing '4 to rank above '3 is quite arbitrary. In particular, we do not have a computation that goes from '4 -states to '3 -states. Every computation follows either the '3 , '1 route or the '4 , '2 route.

1.4 Well-Founded Rule In rule CHAIN-J we treated each of the participating assertions '0 ; : : :; 'm as separate entities, and made no attempt to nd a uniform representation for 'j as

36


Chapter 1: Response

a single formula involving j. This approach is adequate for response properties which require a bounded number of steps for their achievement, e.g., at most ve in the case of program MUX-PET1 (Fig. 1.14). The bound must be uniform and independent of the initial state. There are many cases, however, in which no such bound can be given a priori. To deal with these cases, we must generalize the induction over a xed nite subrange of the integers, such as 0; 1; : : :; m in rule CHAIN-J, into an explicit induction over an arbitrary well-founded relation.

Well-Founded Domains We de ne a well-founded domain (A; ) to consist of a set A and a well-founded order relation on A. A binary relation is called an order if it is transitive: a b and b c imply a c, and irre exive: a a for no a 2 A. The relation is called well-founded if there does not exist an in nitely descending sequence a0 ; a1; : : : of elements of A such that a0 a1 . A typical example of a well-founded domain is (N; >), where N are the natural numbers (including 0) and > is the greater-than relation. Clearly, > is well-founded over the natural numbers, because there cannot exist an in nitely descending sequence of natural numbers n0 > n1 > n2 > : : : . For an arbitrary order relation on A, we de ne its re exive extension < to hold between a, a0 2 A, written a < a0, if either a a0 or a = a0 .

The Lexicographic Product

Given two well-founded domains, (A1 ; 1 ) and (A2 ; 2), we can form their lexicographical product (A; ), where A is de ned as A1 A2 , i.e., the set of all pairs (a1; a2 ), such that a1 2 A1 and a2 2 A2 . is an order de ned for (a1 ; a2); (b1; b2) 2 A by (a1 ; a2) (b1 ; b2) i a1 1 b1 or a1 = b1 ^ a2 2 b2 . Thus, in comparing the two pairs (a1 ; a2) and (b1 ; b2), we rst compare a1 against b1 . If a1 1 b1 , then this determines the relation between the pairs to be (a1; a2 ) (b1 ; b2). If a1 = b1, we compare a2 with b2 , and the result of this comparison determines the relation between the pairs.



37

The order is called lexicographic , which implies that, as when searching in a dictionary, we locate the position of a word by checking the rst letter rst and only after locating the place where the rst letter matches, do we continue matching the subsequent letters. The importance of the lexicographic product follows from the following claim:

Claim (lexicographic product) If the domains (A1 ; 1) and (A2 ; 2 ) are well-founded, then so is their lexicographic product (A; ). Clearly, by the above, the domain (N2 ; ), where is the lexicographic order between pairs of natural numbers, is well-founded. This order is de ned by (n1; n2) (m1 ; m2) i n1 > m1 or n1 = m1 ^ n2 > m2 :

According to this de nition (10; 20) (5; 15) (1; 0) (0; 100) (1; 5) (1; 3). New well-founded domains can be constructed by taking lexicographic products of more than two well-founded domains. Applying this construction to the domain (N; >) of natural numbers, we obtain the domain (Nk ; ), for k 2, where is the lexicographic order between k-tuples of natural numbers. The order is de ned by (n1 ; : : :; nk ) (m1 ; : : :; mk ) i n1 = m1 ; : : :; ni 1 = mi 1 ; ni > mi for some i; 1 i k. For example, for k = 3 (7; 2; 1) (7; 0; 45). It is easy to show that the domain (Nk ; ) is well-founded.

The Rule

Let (A; ) be a well-founded domain. As in rule CHAIN-J, we use several intermediate assertions '1 ; : : :; 'm to describe the evolution from p to q = '0 . Rule CHAIN-J uses the index of the assertion as a measure of the distance from the goal q. The rule presented here associates an explicit ranking function i with each assertion 'i , i = 0; : : :; k. The function i maps states into the set A and is intended to measure the distance of the current state to a state satisfying the goal q. We refer to the value of i in a 'i -state as a rank of the state. The wellfounded rule WELL for response properties is given in Fig. 1.23. Premise W1 states

38


Chapter 1: Response

that every p-position satis es one of '0 ; : : :; 'm . Premise W2 states that every 'i -position with positive i and rank u is eventually followed by a position which satis es some 'j , with a rank lower than u. For assertions p and q = '0 ; '1; : : :; 'm , a well-founded domain (A; ), and ranking functions 0 ; : : :; m : 7! A W1. p !

m _

i=0

'i

W2. 'i ^ i = u ) p )

1

1

_ m j =0

for i = 1; : : :; m 'j ^ u j

q

Fig. 1.23. Rule WELL (well-founded response).

Justi cation It is straightforward to justify rule WELL. Consider a computation that satis es premises W1, W2, and let t1 be a position in which satis es p. By W1, some 'i is satis ed at t1. If it is '0 = q, we are done. Otherwise, let 'i1 , i1 > 0, be the assertion holding at t1 and let u1 denote the rank of the state at position t1 . By W2, there exists a position t2 , t2 t1 , such that some 'j holds at t2 with a rank u2 2 A, such that u1 u2. If j = 0, we are done. Otherwise, we proceed to locate a position t3 t2 . In this way we construct a sequence of positions t1 t2 t3 : : : , and a corresponding sequence of elements from A (ranks) u1 u2 u3 : : : , such that either the sequence is of length k and q = '0 holds at the position tk , or the sequence is in nite and some 'j , j > 0, holds at each ti with rank j = ui there. The later case is impossible since that would lead to an in nitely descending sequence of elements of A, in contrast to the well-foundedness of over A. It follows that for some tk t1, q = '0 holds at tk , which shows that q holds at t1 .

1

Example (factorial)



39

Consider program FACT of Fig. 1.24. This program computes in z the factorial of a nonnegative integer x. We wish to prove for this program the response property ^ z = x!} : |at `0 ^ x 0 {z^ y = x ^ z = 1} ) at| `2 {z p

1

q='0

in x: integer where x 0 local y: integer where y = x out z: integer where z = 1

3 2 `0 : while y > 0 do 64 ` : (y; z) := (y 1; z y)75 1 `2 :

Fig. 1.24. Program FACT (factorial). Intending to use rule WELL with m = 1, it only remains to choose the assertion '1 , and the ranking functions 0 and 1 . This necessitates the identi cation of a well-founded domain (A; ), where A serves as the range of i . Obviously, '1 should describe the intermediate stage in the process of getting from p to q, and 1 should measure the distance of this intermediate stage from the goal q = '0 . Premise W2 ensures that steps in the computation always bring us closer to the goal. For program FACT, a good measure of the distance from termination is the value of y. This is because when we are at `0 , there are y more iterations of the while loop before the program terminates. We therefore choose (N; >) as our well-founded domain and jyj as the ranking function. Thus, (A; ) = (N; >), 0 : 0, and 1 : jyj + 1. The choice of 0 = 0 is natural because, being at a '0 -state, we are already at the goal, and the distance to the goal can therefore be taken as 0. The intermediate assertion '1 should represent the progress the computation has made, so that when y = 0, we can infer that z = x!. Clearly, the way the program operates is that it accumulates in z the product of the terms x (x 1) . In an intermediate stage, z contains the product x (x 1) (y + 1), which can also be expressed as x!=y!, provided 0 y x. We thus arrive at the intermediate assertion ': at `0 ^ 0 y x ^ z = x!=y! .

40


Chapter 1: Response

It only remains to show that premises W1,W2 are satis ed by these choices. Premise W1 This premise requires at | `0 ^ x 0 {z^ y = x ^ z = 1} ! p

_ |at `0 ^ 0 y {z x ^ z = x!=y!} . |{z} '0 '1

This implication is obviously valid. Premise W2 This premise requires showing at | `0 ^ 0 y {z x ^ z = x!=y!} ^ jyj + 1 = n ) '1

1

0at `2 ^ z = x! ^ n > 0 1 |{z} {z } | B CC 0 '0 B B CC B _ B C B @at| `0 ^ 0 y {z x ^ z = x!=y!} ^ n > |jyj{z+ 1}CA '1

1

:

Since '1 ^ jyj + 1 = n implies that n > 0, it is sucient to prove this implication for every n > 0. As '1 implies y 0, we may replace jyj by y. Case n = 1: For this value of n, we prove at | `0 ^ 0 y {z x ^ z = x!=y!} ^ y + 1 = 1 )

1 |

'1

at `2 ^{z z = x!} ^ 1 > 0 ;

1

'0

which simpli es to at `0 ^ z = x! ^ y = 0 ) (at `2 ^ z = x!) . This, of course, can be proven by a single application of rule RESP-J, observing that, under the situation described by the antecedent, only transition `0 is enabled, and taking it leads to at `2 ^ z = x! . Case n > 1: In this case, we will prove



at | `0 ^ 0 y {z x ^ z = x!=y!} ^ y + 1 = n > 1 ) '1

1 |

41

at `0 ^ 0 y {z x ^ z = x!=y!} ^ n > y + 1 : '1

This can be proven by rule CHAIN-J using three assertions, 0, 1 , and 2. The top assertion 2 corresponds to '1 ^ y + 1 = n. Assertion 1 describes the intermediate state, after passing the test of the while statement, and being at `1 . The nal assertion 0 implies '1 ^ y + 1 = n 1 < n, and describes the situation after performing the assignment `1 and arriving back at `0 . The veri cation diagram in Fig. 1.25 describes this proof.

F

C

0 y x; z = x!=y!

F C E D ^

E D y+1 = n> 1

2 : at `0

`0

1 : at `1

`1

0 : at `0

y+1 =n 1

Fig. 1.25. Veri cation diagram for case n > 1. Thus, by treating separately the cases n = 1 and n > 1, we conclude that premise W2 holds for every n 1. This establishes that the conclusion at | `0 ^ x 0 {z^ y = x ^ z = 1} ) |at `2 ^{z z = x!} of rule WELL is valid.

p

1

A Rule with Nontemporal Premises

q

42


Chapter 1: Response

Rule WELL, used for proving response formulas, has as its premise W2, another response formula. This allows a recursive use of the rule, by which the temporal premise W2 is proved either by the simpler rule RESP-J, or by rule WELL again, only applied to simpler assertions. As a matter of fact, if we closely examine the proof of the previous example, we can identify there the use of those two options. For proving W2 for n = 1, we used rule RESP-J , since the response property for this case is accomplished in one step. On the other hand, the case of n > 1 accomplishes W2 in two steps, and we therefore had to use rule CHAIN-J. However, in many cases, we do not need the recursive application of the rule, which means that premise W2 is proved directly by rule RESP-J. In these cases it is advantageous to replace the temporal premise W2 by the nontemporal premises of rule RESP-J, which are necessary for its derivation. This leads to a (combined) form of the rule in which all premises are nontemporal. Such a form is often more satisfactory because it explicitly manifests the power of the rule to derive temporal statements from nontemporal ones. This leads to rule WELL-J (Fig. 1.26). For assertions p and q = '0 ; '1; : : :; 'm , transitions 1 ; : : :; m 2 J , a well-founded domain (A; ), and ranking functions 0 ; : : :; m : 7! A JW1. p !

m _ j =0

'j

2_ 39 m 0 0 ('j ^ i j )7 > 6 > 6 75 > JW2. ^ 'i ! 4j =0 > > _ ('0i ^ i = i0 ) > > = for every 2 T > for i = 1; : : :; m > m _ 0 0 > ('j ^ i j ) > JW3. i ^ 'i ! > > j =0 > ; JW4. ' ! En ( ) i

p )

1

i

q

Fig. 1.26. Rule WELL-J (well-founded response under justice).



43

The rule requires nding auxiliary assertions 'i and transitions i , i = 1; : : :; m, a well-founded domain (A; ), and ranking functions i : 7! A. Each assertion 'i , i > 1, is associated with the transition i that is helpful at positions satisfying 'i , and with its own ranking function i . Premise JW1 requires that every p-position satis es one of '0 ; : : :; 'm . Premises JW2{JW4 impose three requirements for each i = 1; : : :; m. Premise JW2 requires that, taking any transition from a 'i -position k, always leads to a successor position k0 = k + 1, such that either some 'j , j = 0; : : :; m, holds at k0 with a rank j0 lower than i at k, or 'i holds at k0 with a rank i0 equal to the rank i at k. The main implication of premise JW2 is that if the situation has not improved in any noticeable way in going from k to k0 , i.e., the new rank still equals the old rank, at least we have not lost the identity of the helpful transition and the transition that was helpful in k is also helpful at k0. Premise JW3 requires that transition i , which is helpful for 'i , always leads from a 'i -position k to a next position which satis es some 'j and has a rank lower than that of k, i.e., i j0 . Premise JW4 requires that the helpful transition i is enabled at every 'i position.

Justi cation To justify the rule, assume a computation such that p holds at position k, and no later position i k, satis es q = '0 . By this assumption and

JW1, some 'j , j > 0, must hold at position k. Let 'i1 be the formula holding at k, and denote the rank i1 at k by u1. By JW4, transition i1 is enabled at position k. Consider the transition taken at position k, leading into position k +1. By JW2 and JW3, either position k + 1 has a lower rank u2, u2 u1 , or it has the same rank, but then i1 is still the helpful transition at k+1 and is enabled there. In the case that the rank is still u1 , we can continue the argument from k + 1 to k + 2, k + 3, etc. However, we cannot have all positions i > k with the same rank. To see this, assume that all positions beyond k do have the same rank. By JW2 and JW4, this implies that i1 is continuously helpful and enabled. By JW3, i1 is not taken beyond k because taking it would have led to a state with a rank lower than u1 . Thus, our assumption that all positions beyond k have the same rank leads to the situation that i1 is continuously enabled and not taken, violating the justice requirement for i1 . Thus, eventually, we must reach a position k2, k2 > k, with lower rank u2, where u2 u1. In a similar way we can establish the existence of a position k3 > k2, with rank u3 where u3 u2. Continuing in this manner, we construct

44


Chapter 1: Response

an in nitely descending sequence u1 u2 u3 of elements of A. This is impossible, due to the well-foundedness of on A. We conclude that every p-position must be followed by a q-position, establishing the consequence of the rule. Note that since premise JW3 implies premise JW2 for = i , it is sucient to check premise JW2 only for 6= i . Rule CHAIN-J can be viewed as a special case of rule WELL-J which uses i = i, for i = 0; : : :; m, as ranking functions. It is not dicult to see that the premises J2, J3, and J4 of rule CHAIN-J correspond precisely to premises JW2, JW3, and JW4 of rule WELL-J. The well-founded domain used in this special case is the nite segment [0::m] of the natural numbers ordered by >.

Example (factorial)

We use rule WELL-J to prove that program FACT of Fig. 1.24 satis es the response property of total correctness ^ z = x!} : |at `0 ^ x 0 {z^ y = x ^ z = 1} ) at| `2 {z p

1

q='0

Obviously, except for the terminating state, execution of program FACT alternates between states satisfying at `0 in which `0 is the helpful transition, and states satisfying at `1 in which `1 is helpful. Consequently, we take m = 2 and use the following intermediate assertions. '2: at `0 ^ 0 y x ^ z = x!=y! '1: at `1 ^ 1 y x ^ z = x!=y! '0: at `2 ^ z = x! . Note that when control is at `1 , y is required to be greater than or equal to 1. It remains to determine the ranking functions i , i = 0; 1; 2. Our previous analysis of the considered response property for program FACT (using rule WELL) identi ed jyj as a good measure of progress over (N; >). Variable y keeps decreasing as the program gets closer to termination. Unfortunately, premise JW3 of rule WELL-J requires that decreases on each activation of a helpful transition. As we see, not every helpful transition causes jyj to decrease. In particular, `0 does not change jyj. Consequently, we have to supplement jyj by an additional component that will decrease when jyj stays the same. This leads to the following choice: 2 : jyj; 2 1 : jyj; 1 0 : 0; 0 :



45

The corresponding well-founded domain is N f1; 2g; , where is the lexicographical order between pairs of integers. In the previous proof of this property, we used the measure jyj + 1 to ensure that the rank decreases also on the transition from `0 to `2 . Since the use of pairs guarantees such a decrease by a decreasing second component, we can omit the +1 increment and take the rst component to be simply jyj. We may view the ranking function i : (jyj; i) as consisting of a major and a minor measures of progress. Function jyj measures large steps of progress, such as one full iteration of the loop at `0 . The minor component i measures smaller steps of progress. Observe that transition `1 actually causes the minor measure i to increase from 1 to 2, but at the same time it decreases the major measure jyj. Let us consider the premises of rule WELL-J. Since both 'i 's imply y 0, we may replace jyj by y. Premise JW1 We prove JW1 by showing |at `0 ^ x 0 {z^ y = x ^ z = 1} ! p

_ |at `0 ^ 0 y {z x ^ z = x!=y!} ; '2

which is obviously valid. Premises JW2, JW3 for i = 2 For i = 2 we will show ^ |at `0 ^ 0 y {z x ^ z = x!=y!} ! '2

0at 0 `2 ^ z = x! ^ (y; 2) (y0; 0) 1 {z } {z } | | | {z } B CC B 2 0 '0 B CC B _ B CC B 0 0 0 0 0 B C @|at `1 ^ 1 y {z x ^ z = x!=y }! ^ (y; | {z2)} |(y{z; 1)}A 0

0

'1 0

2

1 0

;

for each transition 2 f`0 ; `1 g, not necessarily the helpful one. Obviously, this will satisfy both JW2 and JW3. Since at `0 implies that transition `1 is disabled, the left-hand side of the implication for = `1 is false and the implication is trivially true. For = `0 , we prove the implication by separately considering the cases y = 0 and y 6= 0.

46


Chapter 1: Response

Case y = 0:

In this case `0 implies at 0 `2 , y0 = y = 0, and z 0 = z. Since z = x!=y! and y = 0 imply z = x!, it follows that the left-hand side implies '00 ^ (0; 2) (0; 0). Case y 6= 0: In this case '2 implies that y > 0, which together with `0 , implies at 0 `1 , y0 = y, and z 0 = z. Assertion '2 implies y x ^ z = x!=y! which together with y > 0 establishes '01 . The rank decrease (y; 2) (y; 1) is obvious. Premises JW2, JW3 for i = 1 For i = 1 we will show ^ |at `1 ^ 1 y {z x ^ z = x!=y!} !

_

'1 at 0 `0

|

0 ; 2) ; ^ 0 y0 {z x ^ z 0 = x!=y0}! ^ |(y;{z1)} (y | {z } 1

'2 0

2 0

for each transition 2 f`0 ; `1 g, not necessarily the helpful one. Obviously, this will satisfy both JW2 and JW3. Since at `1 implies that transition `0 is disabled, the left-hand side of the implication for = `0 is false and the implication is trivially true. For = `1 , we observe that `1 implies at 0 `0 , y0 = y 1, and z 0 = z y. Substituting these expressions in the right-hand side of the implication reduces the conjunction to 0 y 1 x ^ z y = x!=(y 1)! ^ (y; 1) (y 1; 2), all of which are either obviously valid or are implied by '1 . Premises JW4 The helpful transitions for '1 and '2 are `1 and `0 , with enabling conditions at `1 and at `0 , respectively. Obviously, they satisfy |at `1{z^ } ! at| {z`1} '1

En (1 ) |at `0{z^ } ! at| {z`0} '2 En (2 )

as required by premise JW4. This establishes the four premises of rule WELL-J, proving the response property of total correctness for program FACT at `0 ^ x 0 ^ y = x ^ z = 1 ) (at `2 ^ z = x!).

1



47

A Condensed Representation of Ranking Functions

Many of our proofs consider ranking functions that consist of lexicographic pairs of natural numbers, i.e., = (d1; d2). Such a function decreases over a transition even if d2 increases, provided d1 decreases at the same time. Lexicographic order implies that even a small decrease in d1 outweights an arbitrarily large increase in d2 . In some cases there exists a bound M, M > 0, which is larger than any possible increase in d2 . In these cases we may use the ranking function b = M d1 + d2, which ranges over N, instead of the original = (d1 ; d2) which ranges over N N. We refer to b as a condensed representation ranking function. In Problem 1.4 the reader is requested to prove that in such cases, b = M d1 + d2 > b 0 = M d01 + d02 i : (d1; d2) 0: (d01; d02). For example, in the above proof of program FACT, we used the ranking functions i : (jyj; i). Since the maximal increase in the value of i is 1 which is smaller than 2, we could have used instead the condensed ranking function bi : 2 jyj + i.

Example (up down)

Consider program UP-DOWN presented in Fig. 1.27. This program can be viewed as an extension of program ANY-Y of Fig. 1.2. Process P1 increments y, counting up in `0 , `1 , as long as x = 0. Once P1 nds that x is dierent from 0, it proceeds to `2 ; `3 , where y is decremented until it becomes 0. Process P2 's single action is to set x to 1. Obviously, due to justice, x will eventually be set to 1. However, one cannot predict the number of helpful steps required for P1 to terminate. The longer P2 waits before performing m0 , the higher the value y will attain on the move to `2 . It is this value of y which determines the number of remaining steps to termination. In fact, for every n > 0, we can construct a computation requiring more than 4n helpful steps to achieve y = 0. This computation allows P1 to increase y up to n, and only then activates m0 . At least 2n more steps of P1 are needed to decrement y back to 0. Consequently, we need rule WELL-J to prove the response property

48


Chapter 1: Response


2`0: while x = 0 do3 66 `1: y := y + 1 77 P1 :: 666`2 : while y > 0 do777 4 `3: y := y 1 5

P2 ::

m0: x := 1 m1 :

`4 :

Fig. 1.27. Program UP-DOWN.

|at `0 ^

at m{z0 ^ x = y = 0} ) p=

1|

at `4 ^{z at m1} q

for program UP-DOWN. In order to construct the intermediate assertions and the ranking functions i , we observe that there are three distinct phases in the achievement of at `4 ^ at m1 . The rst phase waits for P2 to perform m0 . This phase terminates when m0 is executed. In the second phase, P1 senses that x has been set to 1 and moves to `2 . In the third phase, P1 is within `2;3 and decrements y until y reaches 0 and P1 moves to `4 . Consequently, it seems advisable to use the well-founded domain (N3; ) of lexicographic triples (n1 ; n2; n3), whose rst element n1 identi es the phase, and whose remaining elements, n2 and n3 , identify progress within the phase. Recall that lexicographic ordering on triples of natural numbers is de ned by 8 n > m or > < 1 1 (n1 ; n2 ; n3 ) (m1 ; m2 ; m3 ) i > n1 = m1 ; n2 > m2 or : n1 = m1; n2 = m2; n3 > m3: Obviously, this ordering is a well-founded relation on N3. Consider the remaining elements needed to measure progress within a phase. The rst phase terminates after one helpful step, m0 . The second phase terminates in two helpful steps, `1 followed by `0 . The last phase has y measuring coarse progress, and it takes two steps to decrement y, `2 followed by `3 . Consequently, we de ne the following assertions, helpful transitions and ranking functions, '5 : at `0;1 ^ at m0 ^ x = 0 ^ y 0 5 : m0 5 : (2; 0; 0) '4 : at `1 ^ at m1 ^ x = 1 ^ y 0 4 : `1 4 : (1; 0; 1)


1.4 Well-Founded Rule '3 : '2 : '1 : '0 :

at at at at

`0 `2 `3 `4

^ at ^ at ^ at ^ at

m1 ^ x = 1 ^ y 0 m1 ^ x = 1 ^ y 0 m1 ^ x = 1 ^ y > 0 m1

3 : 2 : 1 :

`0 `2 `3

3 : 2 : 1 : 0 :

(1; (0; (0; (0;

49

0; 0) jyj; 2) jyj; 1) 0; 0):

Note that progress within the second phase is measured by the third component, which moves from 1 to 0 on execution of `1 . Progress within the third phase is measured by the pair (y; 1 + at `2 ) which decreases on execution of both `3 and `2 . hh Exercise?ii Let us show that all premises of rule WELL-J are satis ed by these choices.

Premise JW1

For this premise we have to show the implication at | `0 ^ at m{z0 ^ x = y = 0} ! p

_ |at `0;1 ^ at m0{z^ x = 0 ^ y 0}, '5

which is obvious. Premise JW2 for '5 It is sucient to show the following for each 6= m0 ^ at `0;1 ^ at m0 ^ x = 0 ^ y 0 !

|

_

{z

at 0 `0;1 ^

|

'5 at 0 m0

}

0; 0)} = (2; ^ x0 = 0 ^ y0 0 ^ |(2; {z 0; 0) | {z } : {z } 5

'5 0

5 0

The only transitions 6= m0 enabled on '5 -states are `0 and `1 . For each of them, implies at 0 `0;1 , x0 = x = 0, and y0 y 0. Consequently, the implication is valid.

Premise JW3 for '5

We show m0 ^ at `0;1 ^ at m0 ^ x = 0 ^ y 0 !

|

{z

'5

}

50


2at 0 `1 ^ 66| 66 _ 66 64at 0 `0 ^ |

Chapter 1: Response

3 at 0 m1 ^ x0 = 1 ^ y0 0 ^ (2; | {z0; 0)} |(1; {z0; 1)} {z

}

77 77 77 0 0 0 7 at m1 ^ x = 1 ^ y 0 ^ (2; {z } | {z0; 0)} |(1; {z0; 0)}5 '4 0

'3 0

5

4

5

3

0

0

:

Clearly, m0 implies x0 = 1, y0 = y, at 0 m1 and at 0 ì = at ì for i = 0; 1. By '5 , either at `0 or at `1 holds. In the case that at `0 = T, the second disjunct is implied. In the case that at `1 = T, the rst disjunct is implied. The decrease in rank is obvious in both cases.

Premises JW2, JW3 for '4

Since `1 is the only transition enabled on '4 -states, the following implication establishes both JW2 and JW3 for '4 : `1 ^ |at `1 ^ at m1 {z^ x = 1 ^ y 0} !

_

at 0 `0 ^ |

'4 at 0 m1

0; 0) 0; 1)} (1; ^ x0 = 1 ^ y0 0 ^ |(1; {z | {z } : {z } 4

'3 0

3 0

Transition relation `1 implies at 0 `0 , at 0 m1 = at m1 , x0 = x, and y0 y. By '4 , it follows that '03 holds, and the decrease in rank is obvious.


Since `0 is the only transition enabled on '3 -states, the following implication establishes both JW2 and JW3 for '3 `0 ^ |at `0 ^ at m1 {z^ x = 1 ^ y 0} !

_

'3

y0 j; 2)} 0; 0)} (0; at 0 `2 ^ at 0 m1 ^ x0 = 1 ^ y0 0 ^ |(1; {z | j{z

|

{z

'2 0

}

3

2 0

Transition relation `0 under x = 1 implies at 0 `2 and at 0 m1 = at m1 . It also implies x0 = x and y0 = y. The rank decrease (1; 0; 0) (0; jy0j; 2) is obvious, since 1, the rst component of the left-hand side, is larger than 0, the rst component of the right-hand side.


Since `2 is the only transition enabled on '2 -states, the following implication establishes both JW2 and JW3 for '2



51

`2 ^ |at `2 ^ at m1 {z^ x = 1 ^ y 0} ! '2

1 0at 0 `4 ^ at 0 m1 ^ (0; jyj; 2) (0; 0; 0) | {z } {z } | {z } | CC BB 2 0 '0 CC BB C BB _ B@at 0 `3 ^ at 0 m1 ^ x0 = 1 ^ y0 > 0 ^ (0; jyj; 2) (0; jy0j; 1)CCA | {z } | {z } | {z } 0

0

2

'1 0

1 0

:

We distinguish between two cases. Case y = 0: In this case, `2 implies at 0 `4 , y0 = y = 0, and at 0 m1 = at m1 . Since '2 implies at m1 = T, the left-hand side of this veri cation condition implies the right-hand side disjunct '00 ^ (0; jyj; 2) (0; 0; 0). Case y 6= 0: By '2 , it follows that y > 0. In this case, `2 implies at 0 `3 , at 0 m1 = at m1 , x0 = x, and y0 = y > 0. Together with '2, these imply '01 . To show the rank decrease, we observe that jyj = jy0 j and 2 > 1.


Since `3 is the only transition enabled on '1 -states, the following implication establishes both JW2 and JW3 for '1 `3 ^ |at `3 ^ at m1 {z^ x = 1 ^ y > 1} !

_

'1

at 0 `2 ^ at 0 m1 ^ x0 = 1 ^ y0 0 ^ (0; y0 j; 2)} : | j{zyj; 1)} (0; | j{z

|

{z

'2 0

}

1

2 0

Transition relation `3 implies at 0 `2 , at 0 m1 = at m1 , x0 = x, and y0 = y 1. By the clause y > 0 in '1 we have y0 = y 1 0. The decrease in rank follows from y > 0 and (0; jyj; 1) = (0; y; 1) (0; y 1; 2) = (0; jy0j; 2).

Premise JW4

This premise requires showing the following implication for each i = 1; : : :; 5. 'i ! En (i ). By inspecting 'i for each i = 1; : : :; 5, we see that this is indeed the case. This concludes the proof.

52


Chapter 1: Response

Persistence of the Helpful Transitions

Premise JW2 of rule WELL-J requires that, in the case that a transition does not attain a lower rank in the next state, it must maintain the rank and lead to a state that still satis es 'i , and therefore maintain i as the helpful transition. We refer to this clause as a requirement for the persistence of helpful transitions. One may wonder how essential this requirement is, and whether it would be possible to relax this requirement. In Problem 1.5, we request the reader to consider a version of rule WELL-J in which premise JW2 has been relaxed to allow the helpful transition to change without rank decrease. The problem shows that the resulting rule is unsound.

1.5 Rank Diagrams To represent by diagrams proofs of response properties that require the use of well-founded ranking, we have to add some more components to the labels of nodes. A veri cation diagram is said to be a RANK diagram if its nodes are labeled by assertions '0 ; : : :; 'm , with '0 being the terminal node, and ranking functions 0 ; : : :; m , where each i maps states into A, and it satis es the following requirement: Every node 'i , i > 0, has a double edge departing from it. This identi es the transition labeling such an edge as helpful for assertion 'i . All helpful transitions must be just. Note that, unlike CHAIN diagrams, we allow node 'i to be connected to 'j for j > i.

Veri cation and Enabling Conditions for RANK Diagrams

Consider a nonterminal node labeled by assertion ' and ranking function , and let '1 ; : : :; 'k , k 0, be the -successors of ' and 1 ; : : :; k be their respective ranking functions. If transition is unhelpful for ', i.e., labels only single edges departing from the node, then we associate with ' and the following veri cation condition

n

o

' ^ =u

n

o

(' ^ u < ) _ ('1 ^ u 1 ) _ _ ('k ^ u k ) :

If is helpful for ' (labels double edges), we associate with ' and the following veri cation condition n o n o ' ^ = u ('1 ^ u 1 ) _ _ ('k ^ u k ) :


1.5 Rank Diagrams

53

For every nonterminal node ' and a transition labeling a double edge

departing from ', we require ' ! En (). Note that in the case of an unhelpful transition, we allow a -successor with a rank equal to that of ', provided it satis es the same assertion '.

Valid RANK Diagrams

A RANK diagram is said to be valid over program P (P-valid for short) if all the veri cation and enabling conditions associated with the diagram are P-state valid. The consequences of having a valid RANK diagram are stated in the following claim.

Claim 1.2 (RANK diagrams)

A P-valid RANK diagram establishes that the response formula m _

j =0

1

'j )

'0

is P-valid. If, in addition, we can establish the P-state validity of the following implications: p !

m _

j =0

'j

and

'0 ! q

1

then, we can conclude the validity of p ) q.

Justi cation It is not dicultWto see that a valid RANK diagram establishes the premises of rule WELL-J with p: m j =0 'j , q: '0 , and i the transition helpful for 'i being the transition labeling the double edge departing from 'i in the diagram. This establishes the P-validity of m _

j =0

'j )

1

'0 .

Given assertions p and q, satisfying the implications m _

'j and '0 ! q, j =0 we can use rule MON-R of Fig. 1.3 to infer p !

54


Chapter 1: Response

p )

1

q.

Example (factorial)

The diagram of Fig. 1.28 presents a valid RANK diagram that establishes total correctness for program FACT (Fig. 1.24).

F # "

y x; z = x!=y! `0 '2: at `0 ^ 0 y 2 : (jyj; 2) `0

!

C

# ` ' : at ` ^ 1 y : (jyj; 1) " ! D E 1 1

1

'0: at `2 ^ z = x!=y! 0 : (jyj; 0)

1

Fig. 1.28. RANK diagram for total correctness of program FACT. This diagram contains a connection from '1 to '2 which is disallowed in chain diagrams. However, the validity of the implied veri cation conditions ensures that, whenever a transition is taken from a '2 -state s2 to a '1 -state s1 , the rank decreases, i.e., 2 (s2 ) 1 (s1 ).

Distributing the Ranking Functions To make RANK diagrams more readable, we introduce additional encapsulation conventions. One of the useful conventions is that compound nodes may be labeled by a list of assertions. Such labeling indicates that the full assertion associated with a basic (noncompound) node ni is a conjunction of the assertion labeling the node itself and all the assertions labeling compound nodes that contain ni .


1.5 Rank Diagrams

55

Thus, while the label of node '2 in the diagram of Fig. 1.28 is at `0 ^ 0 y, the full assertion associated with this node is at `0 ^ 0 y ^ y x ^ z = x!=y! . We can view this representation as distribution of the full assertion into the part at `0 ^ 0 y labeling the node itself and the part y x ^ z = x!=y! labeling the enclosing node, which is common to both '1 and '2 . In a similar way, we introduce a convention for distribution of ranking functions. The convention allows us to label a compound node by : f, where f is some ranking function mapping states into a well-founded domain A. In most of our examples, the domains are either (N; >) or lexicographic products of this domain. Consider a basic node ni labeled by assertion 'i and local ranking function fb . Assume that node ni is contained in a nested sequence of compound nodes that are labeled by ranking labels : f1 ; : : :; : fm, as we go from the outermost compound node towards ni . This situation is depicted in Fig. 1.29. Then the full ranking function associated with the node 'i is given by the tuple i = (f1 ; : : :; fm ; fb ). That is, we consider the outermost ranking f1 to be the most signi cant component in i , and the local ranking fb to be the least signi cant component.

F C rr F rr C r E r D rr E D

: f1

: fm

ni

'i : : fb

Fig. 1.29. Encapsulated sequence of nodes.

56


Chapter 1: Response

Example (factorial)

In Fig. 1.30, we present a version of the RANK diagram of Fig. 1.28, in which a common component of the ranking function appears as a ranking label of the enclosing compound state.

F # "

y x; z = x!=y! : jyj `0 '2: at `0 ^ 0 y : 2 `0

!

C

# ` ' : at ` ^ 1 y : 1 " ! D E 1

j j

1

'0: at `2 ^ z = x!=y! : ( y ; 0)

1

Fig. 1.30. RANK diagram with distributed ranking functions. The full ranking functions associated with the nodes in the RANK diagram of Fig. 1.30 are identical to those appearing in Fig. 1.28. Another rank distribution convention allows one to omit the local rank labeling a node 'i altogether. This is interpreted as if the node were labeled with the ranking function : i, where i is the index of the node (and the assertion labeling it). In Fig. 1.31, we present another version of the RANK diagram for program FACT, using this convention. The full ranking functions associated with the nodes in this diagram are: 2 : (jyj; 2), 1 : (jyj; 1), and 0 : 0. This raises the question of how to compare lexicographic tuples of unequal lengths such as 2 : (jyj; 2) and 0 : 0. Since all our examples will be based on tuples of non-negative integers, we agree that the relation holding between (a1 ; : : :; ai) and (b1 ; : : :; bk ) for i < k is determined by lexicographically comparing (a1 ; : : :; ai ; 0; : : :; 0) to (b1; : : :; bi ; bi+1;


1.5 Rank Diagrams

F # "

y x; z = x!=y! : jyj `0 '2 : at `0 ^ 0 y `0

!

C

57

# ` ' : at ` ^ 1 y ! D E " 1

1

1

'0 : at `2 ^ z = x!=y!

Fig. 1.31. RANK diagram with default local ranking.

: : :; bk ). That is, we pad the shorter tuple by zeros on the right until it assumes the length of the longer tuple. According to this de nition, (jyj; 2) 0, since (jyj; 2) (0; 0).

Example (up-down)

In Fig. 1.32 we present a valid RANK diagram which implies, by monotonicity, the property of termination for program UP-DOWN (Fig. 1.27). |at `0 ^ at m{z0 ^ x = y = 0} ) at| `4 ^{z at m1} : p=

1

'0

The diagram provides a detailed description of the progress of the computation from '5 to '0 . It shows that progress from '5 to '2 is due to a CHAIN-like reasoning. Then, the progress from '2 and '1 to '0 requires a well-founded argument with the measure jyj for coarse progress, and the index j = 1; 2 of 'j for measuring ne progress. The ranking functions appearing in this diagram are somewhat dierent from the ones used originally. When padded to the maximumlength of 3, they are given by 5 : (5; 0; 0) 4 : (4; 0; 0)

58


Chapter 1: Response

F ^ ^ C F C

y0

'5 : at `0;1

at m0

x=0

| | (5; 0; 0)

m0

at m1 ; x = 1

' : at ` ` ' : at` E ` D atF m ; x=1 : 2; jyjC ` ' : at ` ` ' : at ` ^ y > 0 ` D E 1

| | (4; 0; 0)

0

| | (3; 0; 0)

2

| | (2; jyj; 2)

'0 : at `4 ^ at m1

| | (0; 0; 0)

4

1

3

0

1

2

2

2

E

1

3

3

| | (2; jyj; 1)

D

Fig. 1.32. RANK diagram for termination of UP-DOWN.

3 : (3; 0; 0) 2 : (2; jyj; 2) 1 : (2; jyj; 1) 0 : (0; 0; 0). Note that the diagram contains a connection from '1 to '2 . This is allowed because `3 decrements y and leads to a decrease in rank, stated by


1.6 Response with Past Subformulas

59

(2; jyj; 1) (2; jy 1j; 2). In Problems 1.6{1.9, the reader is requested to prove total correctness of several programs.


1

In this section we generalize the methods and proof rules presented in the preceding sections to handle response formulas p ) q, where p and q are past formulas. The generalization is straightforward. It involves the following systematic modi cations and replacements. Wherever a rule calls for one or more intermediate assertions, the past-version of the rule requires nding past formulas. Each premise of the form ' ! , for assertions ' and , is replaced by an entailment 'b ) b for corresponding past formulas 'b and b. A veri cation condition fpg fqg, for past formulas p and q and transition , is interpreted as the entailment ^ p ) q0 , where the primed version of a past formula is calculated as in Section 4.1 of the SAFETY book. For example, in Fig. 1.33, we present the past version of rule WELL-J. Similar past versions can be derived for rules RESP-J and CHAIN-J.

Example Let us illustrate the use of the past version of rule WELL-J for proving

1

Q

the response property 0ny ) y = n ^ (at `0 ^ y = n) for program UP-DOWN of Fig. 1.27. This property states that any position i at which y is greater or equal to some n 0, is followed by a position j at which y = n and such that, at a preceding position k j, y equaled n while control was at `0 . This property characterizes a feature of program UP-DOWN by which a computation that achieves y n at some state, has at least two occurrences of states in which y = n. One occurrence has control at `0 while the other occurrence has control at `2 . In our proof, we use the following invariants for program UP-DOWN 0 : y 0 1: (at `0;1 ^ at m0 ^ x = 0) _ (at `0::4 ^ at m1 ^ x = 1) 2: at `4 ! y = 0 3: y < n _ (at `0 ^ y = n).

Q

60


Chapter 1: Response

For past formulas p and q = '0 ; '1; : : :; 'm , transitions 1 ; : : :; m 2 J , a well-founded domain (A; ), and ranking functions 0 ; : : :; m : 7! A m _

JW1. p )

'j

j =0

2_ 39 m 0 0 ('j ^ i j )7 > 6 > 6 75 > JW2. ^ 'i ) 4j =0 > > 0 0 _ ('i ^ i = i ) > > = for every 2 T > for i = 1; : : :; m > m _ > ('0j ^ j j0 ) > JW3. i ^ 'i ) > > j =0 > ; JW4. ' ) En ( ) i

p )

1

i

q Fig. 1.33. Past version of rule WELL-J.

State invariants 0 , 1 , and 2 are derived and proven in the usual way. Proving the Invariance of 3

Q

Formula 3 is a past invariant, and can be proven by rule P-INV, taking ' = : y < n _ (at `0 ^ y = n). Premise P1 of rule P-INV is trivial since ' = . Premise P2 requires | at `0 ^{zy = 0 ^ } ! |y < n _ (at{z`0 ^ y = n)} : '0

As n 0, we consider two cases. If n > 0 then y = 0 implies y < n. If n = 0 then at `0 ^ y = 0 implies at `0 ^ y = n. Finally, premise P2 requires showing ^ |y < n _ (at{z `0 ^ y = n)} )

Q

'



0 0 0 |y < n _ (at `0 ^ y ={zn) _ '

0

Q

61

(at `0 ^ y = n) : }

This can be shown by temporal instantiation of the implication ^ (y < n _ p) ! y0 < n _ (at 0 `0 ^ y0 = n) _ p : Obviously if p = T the implication is trivially valid. It therefore remains to show that the following holds: ^ y < n ! y0 < n _ (at 0 `0 ^ y0 = n). This implication can be potentially falsi ed only by a transition that can transform a state satisfying y < n into a next state satisfying :(y0 < n), i.e., y0 n. The only candidate transition is `1 . Therefore, we consider ^ at 0 `0 ^ y0 = y + 1 ^ y < n ! y0 < n _ (at 0 `0 ^ y0 = n).

|

{z

}

As y < n, we consider two cases. If y < n 1 then y0 = y + 1 < n. If y = n 1 then at 0 `0 ^ y0 = y + 1 implies at 0 `0 ^ y0 = n. This concludes the proof of past invariant 3 . Proving the Response Formula

1

To prove the response formula y| = n ^ 0| {z n y} ) p

Q

(at{z `0 ^ y = n)} ; q

we use the past version of rule WELL-J as presented in Fig. 1.33. The choice of intermediate past formulas '1 {'5 , helpful transitions and ranking functions is presented in the veri cation diagram of Fig. 1.34. Note that each of '0 ; : : :; '5 is a past formula. For example, the full formula '4 is given by '4 : at `1 ^ at m1 ^ x = 1 ^ y > n 0 ^ (at `0 ^ y = n).

Q

Let us consider some of the premises required by rule WELL-J. Premise JW1 requires the following implication 0ny ) 1 0 at `0;1 ^ at m0 ^ x = 0 CA : (at `0 ^ y = n) ^ y = n _ y > n ^ B @ _ at `0::3 ^ at m1 ^ x = 1

Q |

{z

'0 _ _ '5

}

62


Chapter 1: Response

F Q

C ^ ^ F C

y > n 0;

(at `0 ^ y = n)

'5 : at `0;1

at m1 ; x = 1

at m0 x = 0

m0

' : at ` ` ' : at` ` 4

1

1

E F

D j j C ^ D E E D

^Q ^ )1 ^Q ^ 3

0

0

at m1 ; x = 1

`2 ' : at ` 2 2 `2

: 2; y

'1 : at `3 y > 0 `3

'0 : y = n

(at `0

Fig. 1.34. RANK diagram for (0 n y)

y = n) y=n

(at `0

It is not dicult to see that this entailment follows from invariants 0{3 . Observe that each 'i , i = 0; : : :; 5 can be written in the form 'i = (at `0 ^ y = n) ^ 'bi , where 'bi is a state formula. Consequently, premise JW2 can be written as follows ^ 'bi ^ (at `0 ^ y = n) )

Q

Q

y = n) .


1.7 Compositional Veri cation of Response Properties

Q Q

(at `0 ^ y = n) 0 ^ 'b00 _

Q

_5 j =1

('b0j ^ i j0 ) _ ('bi ^ i = i0 )

63

:

Since (at `0 ^ y = n) entails (at `0 ^ y = n) 0 , which expands to the disjunction (at `0 ^ y = n) 0 : (at 0 `0 ^ y0 = n) _ (at `0 ^ y = n), it only remains to establish the following state entailment

Q

^ 'bi )

'b0

0

_

_5

j =1

Q

('b0j ^ i j0 ) _ ('bi ^ i = i0 ).

This entailment can be proven in a way similar to the proof of the veri cation conditions in the RANK diagram of Fig. 1.32, whose ranking functions are identical to those of Fig. 1.34. The past conjunct (at `0 ^ y = n) can be similarly factored out also for premise JW3. This concludes the proof that property 0ny ) n = y ^ (at `0 ^ y = n) for program UP-DOWN.

Q

1

Q

1.7 Compositional Veri cation of Response Properties Compositional veri cation is a method intended to reduce the complexity of ver-

ifying properties of large programs. The method infers properties of the whole system from properties of its components, which are proven separately for each component. We apply compositional veri cation to programs that can be decomposed into several top-level processes, called components , which communicate by shared variables and such that every variable of the program can be modi ed by at most one of these components. A variable which is modi ed by component Pi is said to be owned by Pi .

Modular Computations

Let P :: declarations; P1 :: [`10: S1 ]k kPk :: [`k0 : Sk ] be a program, and Pi be a component of P. Denote by V = fg [ Y the set of system variables of P, and let Yi Y be the set of variables owned by Pi. Let Li denote the set of locations of process Pi .

64


Chapter 1: Response

Assume that we have constructed the fair transition system (FTS) SP : hV; ; T ; J ; Ci corresponding to P. We assume that the initial condition has the form ^ : = f`10 ; : : :; `k0 g ^ py (y), y 2Y

where, for each y 2 Y , py (y) is an assertion constraining the initial values of variable y. Obviously, py (y) is derived from one of the where clauses in the declarations of variables in P. If there is no where clause constaining y, then py (y) = T. Let Ti denote the transitions of SP associated with the statements of Pi . Based on the FTS SP and process Pi, we construct a new FTS SPMi : hVi ; i ; Ti; Ji ; Ci i called the modular FTS corresponding to Pi. The FTS SPMi is intended to capture the possible behavior of process Pi in any context (not necessarily that of P) which respects the ownership of Yi by Pi . That is, we are ready to consider any context whose only restriction is that it cannot modify any variable owned by Pi. The constituents of SPMi ar given by: Vi : V The system variables of SPMi are identical to the system variables of the complete FTS SP . ^ py (y) i : \ Li = fì0 g ^ y2Yi

The initial condition of SPMi requires that, initially, the only Li -location contained in is ì0 and all the variables owned by Pi satisfy their initial constraints as speci ed in the where clauses of the program declarations. Except for , nothing is required by i concerning the system variables not owned by Pi. Ti = Ti [ fE g The transitions of SPMi include all transitions associated with statements of Pi (Ti ) and a special environment transition E . Transition E is intended to represent the actions of an arbitrary context which respects the ownership of Yi by Pi. For each 2 Ti , the transition relation SPMi associates with is , the transition relation SP associates with . The transition relation for E is given by E : (0 \ Li = \ Li ) ^ press (Yi ). This transition relation guarantees the preservation of the Li -part of and preservation of the values of all variables owned by Pi . The special treatment of can be described by saying that, in addition to owning the variables in Yi , Pi also owns the Li -part of (projection of on Li ).



65

Ji = J \ Ti

The just transitions of SPMi are the just transitions among Ti . Ci = C \ T i The compassionate transitions of SPMi are the compassionate transitions among Ti . There is no need to include the idling transition I in Ti because the eect of I , a transition that changes no system variable, can be obtained as a special case of E . We refer to each computation of FTS SPMi as a modular computation of process Pi . As previously explained, any such computation represents a possible behavior of process Pi when put in an arbitrary context which is only required to respect the ownership rights of Pi .

Example (program KEEPING-UP)

Consider program KEEPING-UP presented in Fig. 1.35. Top-level process P1 owns variable x and the `0::2 -part of . We use `0::2 as abbreviation for f`0 ; `1; `2 g. We can construct SPM1 , the modular FTS corresponding to process P1 as follows:


2` : loop forever do 3 0" #7 6 P1 :: 64 `1 : await x < y + 1 75 `2 : x := x + 1

2m : loop forever do 3 0" #7 6 P2 :: 64 m1 : await y < x + 1 75 m2 : y := y + 1

Fig. 1.35. Program KEEPING-UP.

V1 : f; x; yg 1 : \ `0::2 = f`0g ^ x = 0 T1: f`0 ; `1 ; `2 ; E g

with the following transition relations (after some simpli cations): `0 : move (`0 ; `1) ^ pres (x; y) `1 : move (`1 ; `2) ^ x < y + 1 ^ pres (x; y) `2 : move (`2 ; `0) ^ x0 = x + 1 ^ pres (y)

66


Chapter 1: Response

E : (0 \ `0::2 = \ `0::2) ^ pres (x) In this relations, we used the following abbreviation: move (ì ; `j ): at ì ^ 0 = fì g [ f`j g J1 : f`0 ; `1 ; `2 g C1 : ; The following is a modular computation of process P1:

0 : f` ; m g; x: 0; y: 0 `!1 b: : f`0 ; m0g; x: 0; y: 0 `! 1 0

: f` ; m g; x: 0; y: 0 ! E : f` ; m g; x: 0; y: 1 `! 2 2 0

: f` ; m g; x: 1; y: 1 : 2 0 0

0

In a similar way, we can construct SPM2 , the modular FTS corresponding to process P2. The following claim establishes a connection between computations of the entire program and modular computations of its processes.

Claim 1.3 (computations of programs and modular computations)

Every computation of a program is a modular computation of each of its top-level processes. Thus, the set of computations of the entire program is a subset of the set of modular computations of each of its top-level processes.

Example Consider, for example, the following computation of program KEE-

PING-UP

:

: f` ; m g; x: 0; y: 0 0 0

: f` ; m g; x: 0; y: 0 2 0

: f` ; m g; x: 1; y: 0 0 1

: f` ; m g; x: 1; y: 1 0

0

: f` ; m g; `! 0 1 0

m! 0 : f`2 ; m1g;

m! 1 : f`0 ; m2g;

: f` ; m g; `! 0 1 0

x: 0; y: 0 x: 1; y: 0 x: 1; y: 1

x: 0; y: 0

`! 1

`! 2

m! 2

:

Viewed as a modular computation of process P1 , this computation can be presented as:


1.7 Compositional Veri cation of Response Properties 1 :

: f` ; m g; x: 0; y: 0 0 0

: f` ; m g; x: 0; y: 0 2 0

: f` ; m g; x: 1; y: 0 0 1

: f` ; m g; x: 1; y: 1 0

0

: f` ; m g; `! 0 1 0 E

! : f`2 ; m1g; E

! : f`0 ; m2g;

: f` ; m g; `! 0 1 0

x: 0; y: 0 x: 1; y: 0 x: 1; y: 1

x: 0; y: 0

67

`! 1

`! 2

E

! :

Viewed as a modular computation of process P2 , this computation can be presented as:

E : f` ; m g; x: 0; y: 0 ! E 2 : : f`0 ; m0g; x: 0; y: 0 ! 1 0

: f` ; m g; x: 0; y: 0 m!0 : f` ; m g; x: 0; y: 0 ! E 2 0 2 1

: f` ; m g; x: 1; y: 0 m!1 : f` ; m g; x: 1; y: 0 m!2 0 1 0 2

: f` ; m g; x: 1; y: 1 ! E : f` ; m g; x: 1; y: 1 : 1 0 0 0

This illustrates that a computation of a program is a modular computation of each of its top-level processes. The weak converse of Claim 1.3 is not true. There are modular computations of process Pi which do not correspond to computations of the entire program. This is illustrated by b the previously presented modular computation of process P1 in program KEEPING-UP. This computation contains a state with y = 1 as a E -successor of a state with y = 0. No such state can occur in a computation of KEEPING-UP. This shows that the de nition of modular computations of process Pi allows more general contexts than the actual context provided by the program containing Pi . The actual context of P1 within program KEEPING-UP is process P2 which can never change y from a value of 0 to a value of 1. On the other hand, the strong converse of Claim 1.3 is true. Let be a model (in nite state sequence) such that the interpretation of is a subset of the locations of P. The valid converse of Claim 1.3 states that if is simultaneously a modular computation of every top-level process of P then is a computation of P. In Problem 1.10, we request the reader to prove this fact.

Modular Validity and a Basic Compositionality Rule

For a top-level process Pi within program P, we say that formula ' is modularly

q

valid over Pi , denoted

0

Pi m ', if ' holds over all modular computations of Pi . For example, the formula (x x ), stating that x never decreases, is modularly valid over process P1 of program KEEPING-UP (Fig. 1.42), while (y y ) is modularly valid over process P2 of the same program2 .

0

2 x and y denote the values of x and y in the preceding state.

68


Chapter 1: Response

Rule COMP-B, presented in Fig. 1.36, infers the P-validity of a formula ' from the premise that ' is modularly valid over some top-level process of P. For a program p, Pi a top-level process of P, and ' a temporal formula Pi m ' P

q q

'

Fig. 1.36. Rule COMP-B (basic compositionality).

Soundness

q

Let P be a program and Pi be a top-level process of P. Assume that formula ' is modularly valid over Pi , i.e. Pi m '. This means that ' holds over all modular computations of Pi . By Claim 1.3, every computation of P is also a modular computation of Pi . It follows that all computations of P satisfy ' and, hence, ' is P-valid.

q

Rule COMP-B can be used to reduce the goal of establishing P ' into the subgoals of establishing several modular validities (not necessarily of the same formula '. In Problem 1.11 the reader is requested to establish this fact.

A Compositional Rule for Safety Properties In theory, rule COMP-B is adequate for compositional veri cation of any temporal formula. In practice, however, its application often proves inconvenient and calls for additional temporal reasoning. Therefore, it is advantageous to derive more speci c rules, each of which is tailored to deal with temporal formulas of particular classes. In Fig. 1.37 we present rule COMP-S which can be used for compositional veri cation of safety formulas. Premise CS1 states that is an invariant of the entire program P. Premise CS2 states that the entailment ) p is modularly valid over some top-level process Pi . From these two assumptions, the rule infers that p is an invariant of P.

`

Justi cation Assume that premises CS1 and CS2 hold and let be a computation of program P. By premise CS1, formula holds at all positions of . Since



69

qq 0 ` q0

For Pi , a top-level process of program P, and past formulas , p, CS1. P CS2. Pi m ) p P

p

Fig. 1.37. Rule COMP-S (compositional veri cation of safety properties).

`

every computation of P is also a modular computation of Pi , premise CS2 implies that the formula ! p holds at all positions of . Consider an arbitrary position j 0 of . By D1, holds at all positions k j and, therefore holds at j. By CS2, ! p holds at j and, therefore, so does p. We conclude that p holds at all positions of .

`

q 0 q0 q0

`

Rule COMP-S is often used in an incremental style. As a rst step we take = T and prove Pi m p1 . From this the rule infers P p1 . Next, we take = p1 and prove Pi m p1 ) p2 . This leads to P p2 , which may be followed by additional steps. The advantage of this proof pattern is that in each step we concentrate on proving a modular validity over a single process Pi . If Pi is only a small part of the program, each compositional veri cation step has to consider only a small fraction of the transitions in the complete program. We illustrate the use of rule COMP-S on a simple example.

Example (program KEEPING-UP)

q`

Consider program KEEPING-UP presented in Fig. 1.35. Process P1 in this program repeatedly increments x, provided x does not exceed y + 1. In a symmetric way, process P2 repeatedly increments y, provided y does not exceed x + 1. We wish to prove for this program the invariance of the assertion jx yj 1, i.e., |jx {zyj 1} ;

0

p

70


Chapter 1: Response

claiming that the dierence between x and y never exceeds 1 in absolute value. We prove this property by compositional veri cation, using rules INV-P and COMP-S. We rst show the P-validities P (x x ) and P (y y ), and then the P-validities P (x y + 1) and P (y x + 1). The invariants x y + 1 and y x + 1 imply the desired P-validity P (jx yj 1). For more details of this proof, we refer the reader to Section 4.3 of the SAFETY book.

q0 q0 q0

q0 q0

A Compositional Rule for Response Properties Next, we present a rule that can support compositional veri cation of response properties and illustrate its use. This is rule COMP-R, presented in Fig. 1.38.

qq 0 1 q )1

For Pi , a top-level process of program P, and past formulas , p, and q, CR1. P CR2. Pi m p ) (q _ :) P

p

q

Fig. 1.38. Rule COMP-R (compositional veri cation of response properties).

Justi cation Assume that premises CR1 and CR2 hold and let be a computation of program P. By premise CR1, formula holds at all positions of . Since every computation of P is also a modular computation of Pi , premise MR2 implies that the formula p ! (q _ :) holds at all positions of . Let j be a p-position of . By MR2, there exists a position k j such that either q holds at k or is false at k. The second alternative is impossible, due to CR1. We conclude that every p-position is followed by a q-position and, therefore, p ) q is valid over P.

1

Example (program PING-PONG)

1



71

local x; y; z: integer where x = y = z = 0

2own out x; z 3 77 66`0: x := 1 6 P1 :: 66`1 : await y > 0777 5 4`2: z := 1 `3 :

3 2own out y 6m : await x > 077 P2 :: 664m0 : y := 1 75 1 m2 :

Fig. 1.39. Program PING-PONG.

We illustrate the use of rule COMP-R for compositional veri cation of response properties on an example. In Fig. 1.39, we present program PING-PONG. The two processes of this program maintain a coordination protocol. The protocol starts by P1 setting x to 1 at statement `0 . This is sensed by P2 at m0 , and is responded to by setting y to 1 at statement m1 . This is sensed by P1 at `1 , and is responded to by setting z to 1 at `2 . We wish to establish for this program the response property ) (z = 1). We start by proving, using rule P-INV, the modular invariance P1 m (x x ). This is easy to prove since the local formula x x is inductive over the modular FTS corresponding to process P1. By rule COMP-B we can infer P (x x ). In a similar way, we establish P2 m (y y ), leading to P (y y ). Now, we use rule RESP-J to prove P1 m |{z} ) x| {z > 0} :

1 q0

q0 q0 q

q0

1

p

q

As the intermediate assertion and helpful transition, we take ': at `0 and h : `0 . Using rule COMP-R with : T, we conclude P ) (x > 0).

q

1

72


Chapter 1: Response

q 1 q 0 | {z } )1 _ ?

_

Next, we intend to establish P2 m x > 0 ) (y > 0 _ x < x ). As a rst step, we use rule INV to prove P2 m at m0;1 _ y > 0 : '2

Having established the modular invariance of '2 over P2 , the following veri cation diagram proves that x > 0 (y > 0 x < x ) is modularly valid over P2. E x>0 at m0 m0

at m1 m1

y>0 x<x

Note that the diagram allows the possibility that the environment changes x from a positive value to a nonpositive one. However, such a change leads to a position satisfying x < x . Now, use rule COMP-R with : x x , p: x > 0, and q: y > 0, to conclude P x > 0 ) (y > 0). Next, we plan to establish P1 m y > 0 ) (z = 1 _ y < y ). As a rst step, we use rule INV to prove P1 m (at `0::2 _ z = 1). Having established this modular invariant, the following veri cation diagram proves that y > 0 ) (z = 1 _ y < y ) is modularly valid over P1. E y>0

q q q0

1 1

1

?

_ q )1 )1 )1 )1 at `0 `0

at `1 `1

at `2 `2

z=1

y < y0

Now, use rule COMP-R with : y y , p: y > 0, and q: z = 1, to conclude P y>0 (z = 1). Thus, we have shown that the three response properties (x > 0), x>0 (y > 0), and y > 0 (z = 1) are all valid over program PING-PONG. Using rule TRNS-R, we conclude


1.8 Guarantee Properties )

1

73

(z = 1).

1.8 Guarantee Properties In this and the following section we consider methods for proving properties belonging to the guarantee and obligation classes. Our approach to these classes is to consider them as special cases of the response class, and to use response rules with some simpli cations for their veri cation. As de ned in Section 0.5 of the SAFETY book, guarantee properties are properties that can be speci ed by a formula of the form r for some past formula r. Clearly, guarantee properties are a special case of response properties, p ) r, where the antecedent p refers to the beginning of the computation. Consequently, an obvious rule for proving guarantee properties, is rule GUAR (Fig. 1.40).

1

1

For past formula r

rst ^ )

1

r

1

r

Fig. 1.40. Rule GUAR (proving guarantee properties). The rule requires as a premise a response property by which the initial condition of the program guarantees the eventual realization of r.

Example Consider system INC2, presented in Fig. 1.41.

1

Q

We wish to establish the guarantee property x 20 ^ (x = 10) for system INC2, using rule GUAR. The premise of rule GUAR requires the response property

z

}|p

{

rst ^ x| {z = 0} )

1 | ^ {zQ x 20

r

(x = 10)} :

This response property can be proven by rule WELL-J, using the intermediate past formula

74


Chapter 1: Response

V : fx: integerg : x = 0 T : fI ; g where : x0 = x + 2 J : f g C: ; Fig. 1.41. System INC2.

Q

': even (x) ^ 0 x 18 ^ x 10 ! (x = 10) ; the helpful transition , and the ranking function : j20 xj. Let us establish premise JW1 of rule WELL-J. It requires showing | ^{zx = 0} ) _ even (x) ^ 0 x 18 ^ x 10 ! (x = 10) :

|

p

{z '

Q

}

Clearly, x = 0 entails all three conjuncts comprising '. Note that, in this case, we do not use the conjunct rst which is part of p. By rule GUAR, we conclude that property x 20 ^ (x = 10) is valid over system INC2.

1

Q

The premise of rule GUAR contains rst as part of the antecedent. Its purpose is to ensure that we only consider at the beginning of the computation. As illustrated in the last example, in many cases we do not use this conjunct and simply prove ) p. There are, however, some cases in which this conjunct is necessary, as illustrated below.

1

Example Consider the simple program local x: integer where x = 1 `0 : loop forever do [`1 : skip; `2 : x := x].

1

`

We consider the guarantee property : at `2 ^ (x = 1) : This property states that every computation of the program contains a position j satisfying at `2 , and such that x = 1 at all positions i j.


1.8 Guarantee Properties

75

This property is certainly valid for the program. To prove it, we have to establish the response property rst ^ at `0 ^ x = 1 ) at `2 ^ (x = 1) : Note, however, that the rst conjunct is essential in this case, since the formula at `0 ^ x = 1 ) at `2 ^ (x = 1) is not valid over the program. Consider position i in the computation, corresponding to the third visit to `2 . At this position x = 1, but there exist earlier positions in which x = 1. Therefore, there exists no position later than i, at which at `2 ^ (x = 1) holds. It follows that the implication at `0 ^ x = 1 ! at `2 ^ (x = 1) does not hold at i. To prove that the full premise rst ^ at ` ^ x = 1 ) at ` ^ (x = 1) | {z0 } } ; | 2 {z

1

1

`

`

``

1

1

p

`

r

is valid, we may use rule CHAIN-J (Fig. 1.7) with the following intermediate past formulas and helpful transitions: '2 : at `0 ^ (x = 1) 2 : `0 '1 : at `1 ^ (x = 1) 1 : `1 '0 = r: at `2 ^ (x = 1) 0 : `2 :

`` `

`

Premise J1 requires showing | rst ^ at {z`0 ^ x = 1} ) _ |at `0 ^ {z (x = 1)} : p

`

'2

Clearly, the antecedent implies at `0 . To see that it also implies (x = 1), we observe that under rst , any past formula p is congruent to (p)0 , the initial version of p. Since the initial version of (x = 1) is (x = 1) 0 = (x = 1), the right-hand side simpli es to at `0 ^ x = 1 which is entailed by the left-hand side. Another premise that has to be checked is J3 for transition `0 , `0 ^ |at `0 ^ {z (x = 1)} ) _ at 0 `1 ^ x0 = 1 ^ (x = 1) :

`

`

`

'2

`

|

{z

'1 0

`

}

Since `0 implies at 0 `1 and x0 = x, and (x = 1) implies x = 1, the entailment is valid.

76


Chapter 1: Response

1

`

The rest of the premises are proven in a similar way. This establishes the validity of at `2 ^ (x = 1) :

Completeness of Rule GUAR

1

1

Rule GUAR is obviously sound, which means that the P-validity of the premise r implies the P-validity of the conclusion r. The rule is also complete , which means that the P-validity of the conclusion implies the P-validity of the premise. Consider , an arbitrary computation of program P. By the assumption that r is P-valid, there exists a position k at which r holds. For to satisfy the premise we have to show that every position i 0, satisfying rst ^ , is followed by a position j, j i, satisfying r. Since 0 is the only position satisfying rst ^ , we can take j to be k. Completeness of rule GUAR is important because it tells us that the rule is adequate for proving all P-valid guarantee formulas. rst ^ )

1

1.9 Obligation Properties Before studying the class of obligation properties, we introduce a special class of response formulas.

Escape Formulas

0 1

Some response properties are naturally expressed by formulas of the form p ) q _ r, for past formulas p, q, and r. This formula claims that, following a p-state, either q will hold forever or r eventually occurs. We may view such a formula as stating that, following p, q should hold continually unless we escape to a state that eventually leads to r. Consequently, we refer to formulas of this form as escape formulas . To see that this formula speci es a response property, observe that it is equivalent to :q ^ (:r) (p ^ :r) ) r. In this form, the formula states that every :q-position preceded by a p-position such that no r has occured since, must be followed by an r-position. While, in principle, it is possible to use the general response rules to establish escape formulas, it is more convenient to use a special rule, presented in Fig. 1.42.

1


1.9 Obligation Properties

77

For past formulas p, q, r, and ' E1. p ) q W ' E2. ' ) r p )

1

0 _1 q

r

Fig. 1.42. Rule ESC (escape).

Rule ESC uses an auxiliary past formula '. Premise E1 requires that, following a p-position, either q will hold forever or q will hold until an occurrence of '. Premise E2 requires that every '-position is followed by an r-position. Typically, we prove E1 by rule P-WAIT, a past version of rule WAIT (Fig. 3.3 of the SAFETY book), and E2 by appropriate response rules.

Example Consider program MAY-HALT of Fig. 1.43. This trivial program has

a nondeterministic choice at `1 between getting deadlocked at `2 or, taking the à1 branch, proceeding to `3 . Consequently, the program has some computations that reach `2 and stay there forever, and some computations that never halt. `0 : loop forever do 2 2a 33 ` : skip 66` : 64 1 or 7577 7 66 1 b 66 `1: skip; `2: halt 777 5 4`3: skip `4 : skip Fig. 1.43. Program MAY-HALT (possible deadlock).

0

We use rule ESC to prove the property at 1: at `0;1 ) | {z`0::2} _

| {z }

for this program. Take

p

q

1 | {z } at `4 r

78


Chapter 1: Response

': at `3 . Consider the two premises of rule ESC.

Premise E1 This premise requires at `0;1 ) |at {z`0::2} W at | {z`3} :

| {z }

q

p

'

It is straightforward to derive this property by rule WAIT.

Premise E2 at | {z`3} ) '

1 | {z }

at `4 : r

A single application of rule RESP-J establishes this property. This establishes the considered escape property.

From Escape to Obligation The (simple) obligation class includes all the properties that can be speci ed by a formula of the form

0 _1 q

r,

for past formulas q and r. We observe that such a formula can be rewritten as

| rst{z^ } ) p

0 _1 q

r,

which represents it as a special case of an escape formula. This observation inspires rule OBL (Fig. 1.44) for proving obligation proper-



79

For past formulas q, r, and ', O1. rst ^ ) q W ' O2. ' ) r

1

0 _1 q

r

Fig. 1.44. Rule OBL (proving obligation properties).

ties.

Premise O1 requires that, from the beginning of the computation, q holds continuously and can be interrupted only at a position satisfying '. Premise O2 states that ' guarantees an eventual r. Consequently, q can be interrupted only when r is guaranteed. It follows that q W ( r) is valid. By properties of the waiting-for operator, we may deduce q _ r. Example (incrementor-decrementor) Consider Program INC-DEC presented in Fig. 1.45, which nondeterministically increments or decrements an integer variable y.

0 11

local x: boolean where x = T y: integer where y = 10 `0 : loop forever do 2à: hwhen x do y := y + 1i 1

66 or 6 b `1 : 66`1 : hwhen x do x := Fi 4 or

`c1 : hwhen :x do y := y 1i

3 77 77 75

Fig. 1.45. Program INC-DEC (nondeterministic incrementor-decrementor).

0

1

We wish to prove for this program the obligation property |y {z10} _ y| {z= 0} : q

r

80


Chapter 1: Response

Intending to apply rule OBL, it only remains to identify the intermediate formula '. The main characterization of ' is that it describes the event whose occurrence guarantees the eventual realization of r. Examining the program, we see that the rst moment we realize that y = 0 is going to happen is when x becomes false. Consequently we take ': :x ^ y > 0. The premises that have to be veri ed are as follows: Premise O1 To establish this premise it suces to prove | {z^ } ) y| {z10} W |:x ^{zy > 0} :

bp

bq=q

br='

To prove this we use rule WAIT (Fig. 3.3 of the SAFETY book) with the intermediate assertion 'b: x ^ y 10. The three premises of rule WAIT require y 10} _ ; W1. |at `0 ^ x{z ^ y = 10} ! |x ^ {z

b'

bp

which is obviously state valid. W2. |x ^ {z y 10} ! y| {z10} ;

b'

bq

which is trivially state valid. W3. ^ x| ^ {zy 10} ! |x0 ^ {z y0 10} _ :| x0 ^{zy0 > 0} ;

b'

b'

0

br

0

for all transitions in the program. It is not dicult to see that all three requirements are valid. Premise O2 To establish this premise we have to prove |:x ^{zy > 0} ) y| {z= 0} :

1

'

r

This is proven by the RANK veri cation diagram presented in Fig. 1.46. This concludes the proof of (y 10) _ (y = 0).

0

1



81

:x; y > 0 : y

' : at ` ` ' : at` ` ` ' : y= 0 2

0

0

1

c 1

1

c 1

0

Fig. 1.46. Veri cation diagram for :x ^ y > 0 )

1

(y = 0).

A general obligation property is a conjunction of the form

^n

i=1

0 1

( qi _

ri ).

Consequently, to prove the validity of such a formula, it is sucient (and necessary) to prove the validity of each conjunct, which is a simple obligation property.

Completeness of rule OBL

0 1

Rule OBL is complete for proving (simple) obligation properties. This means that, whenever q _ r is P-valid, we can nd a past formula ', such that premises O1 and O2 are also P-valid. The choice we can always make is taking ': r _ (:q ^ :r). We will show that, if the property q _ r is P-valid, then the two premises of rule OBL are also P-valid for this choice of '. Premise O1 For premise O1 it suces to show that q W |r _ (:q{z^ :r)}

`0 1

'

`

is P-valid. This formula states that either q holds forever, or it is interrupted by an r, or

82


Chapter 1: Response

it is interrupted by a :q-position which is not preceded by any r-position. This formula is valid in general so, in particular, it holds over all computations. Premise O2 This premise requires |r _ (:q{z^ :r)} ) r,

`

`

'

1

1

for which it is sucient to show :q ^ :r ) r. Assume to the contrary, that there exists a computation and a position i such that :q ^ :r holds at i, but r does not hold at any position j i. Since :q ^ r holds at i, r does not occur at any position j < i. Therefore does not satisfy r. On the other hand, since :q at i, also does not satisfy q. This contradicts our assumption that q _ r is P-valid. Consequently, premise O2 is also P-valid. As we continuously remind the reader, the auxiliary formula ' constructed during a proof of completeness is not necessarily the one we recommend for actual use. In practice, we can almost always nd better assertions.

`1 `

0 1

0

Problems Problem 1.1 (three values)

page 22 Prove accessibility for process P1 of program MUX-VAL-3 of Fig. 1.47. This program uses the shared integer variables y1 and y2 . Obviously, these variables can only assume one of the values f 1; 0; 1g. Accessibility for P1 is stated by the response formula at `2 ) at `4 .

1

Problem 1.2 (bakery algorithms)

page 25 (a) Prove accessibility for process P1 of program MUX-BAK-A of Fig. 1.48. Note that the two processes are not exactly symmetric due to the dierence between statements `b3 and mb3 . The algorithm is called the bakery algorithm, since it is based on the idea that customers, as they enter, pick numbers which form an ascending sequence. Then, a customer with a lower number has higher priority in accessing its critical section. Statements `2 and m2 ensure that the number assigned to yi , i = 1; 2, is greater than the current value of yj , j 6= i.


Problems

83

local y1 ; y2: integer where y1 = y2 = 0

2`0: loop forever do 3 37 66 2`1: noncritical 66 6 *if y = 1 +7777 7777 2 66 66 6 66 6`2: then y1 := 1 7777 66 66 else y1 := 1 7777 66 66`3: await y2 6= y1 7777 7575 64 64`4: critical `5 : y1 := 0

2m0: loop forever do 3 66 2m1 : noncritical 377 66 6 *if y = 1 +777 7777 1 66 66 6 66 6m2 : then y2 := 1 7777 66 66 else y2 := 1 7777 6 66 6m3 : await y1 6= y2 7777 7575 64 64m4 : critical m5 : y2 := 0

Fig. 1.47. Program MUX-VAL-3.

local y1 ; y2: integer where y1 = y2 = 0

3 2` : loop forever do 0 2 377 66 66 6`1: noncritical 77777 66 66`2: y21 := y2 + 1 66 66 à3 : await y2 = 0 3777777 777 66 66`3: 64 or 66 66 `b3: await y1 y25777777 7777 66 66 55 4 4`4: critical `5 : y1 := 0

3 2m : loop forever do 0 2 377 66 66 6m1: noncritical 77777 66 66m2: 2y2 := y1 + 1 37 66 66 ma3 : await y1 = 0 77777 757777 66 66m3: 64 or 66 66 b m3 : await y2 < y1 777777 66 66 7575 4 4m4: critical m5 : y2 := 0

Fig. 1.48. Program MUX-BAK-A.

(b) Program MUX-BAK-A does not obey the LCR restriction. In particular, statements `2 and m2 each contain two critical references: to y1 and to y2 . To correct this situation, we propose program MUX-BAK-C of Fig. 1.49. This LCR-program contains two additional await statements that ensure that processes do not wait too long at locations `3 or m3 . Show that program MUX-BAK-C guarantees accessibility for process P1.

Problem 1.3 (variants of Dekker's algorithm))

page 32

84


Chapter 1: Response

local y1 ; y2 ; t1; t2: integer where y1 = y2 = 0 x1 ; x2 : integer where x1 = x2 = 0

3 2` : loop forever do 0 66 2`1: noncritical 377 66 6` : x := 1 77777 66 66 2 1 66 66`3: t1 := y2 + 1 777777 7777 66 66`4: y1 := t1 77 66 66`5: x1 := 0 66 66`6: await x2 = 0 777777 66 66 2await y = 0 37777 2 66 66 6 75777777 66 66`7: 4 or 66 66 await y1 y2 777777 7575 64 64`8: critical `9 : y1 := 0

3 2m : loop forever do 0 66 2m1: noncritical 377 66 6m : x := 1 77777 66 66 2 2 66 66m3: t2 := y1 + 1 777777 7777 66 66m4: y2 := t2 77 66 66m5: x2 := 0 66 66m6: await x1 = 0 777777 66 66 2await y = 0 37777 1 66 66 6 75777777 66 66m7: 4 or 7 66 66 await y2 < y1 77777 7575 64 64m8: critical m9 : y2 := 0

Fig. 1.49. Program MUX-BAK-C.

(a) Prove accessibility for process P1 of program MUX-DEK-A of Fig. 1.50. That is, show that the response formula at `2 ) at `7 is valid over MUX-DEK-A. (b) Prove accessibility for process P1 of program MUX-DEK-B of Fig. 1.51. That is, show that the response formula at `2 ) at `7 is valid over MUX-DEK-B.

1

1

Problem 1.4 (condensed form of ranking functions)

page 47 In the text, it was suggested that a ranking function = (d1; d2), where d1 and d2 < M are natural numbers, can always be replaced by the ranking function b = M d1 + d2 . Show that if both d2 < M and d02 < M, then b = M d1 + d2 > b0 = M d01 + d02

i

Problem 1.5 (rule with relaxed premise JW2)

: (d1 ; d2) 0: (d01; d02). page 52


Problems

85

local y1 ; y2 ; t: integer where y1 = y2 = 0; t = 1

2 3 `0 : loop forever do 377 66 2` : noncritical 66 6 1 77777 66 66`2: y1 := 2 66 66`3:2while y2 = 2 do 3777777 77 66 66 `4: y1 := 1 66 66 66 2await t = 1 377777777 66 66 66 6 7577777777 66 66 66`5: 4 or 7 66 66 4 await y2 = 0 75777777 7777 66 66 `6: y1 := 2 7777 66 66` : critical 7777 66 66 7 55 4 4`8: t := 2 `9 : y1 := 0

3 2m0: loop forever do 377 66 2m1: noncritical 7 66 6m2: y2 := 2 66 66m : while y = 2 do 777777 1 66 66 32 3777777 66 66 m4 : y22 := 1 37777777 66 66 66 await t = 2 66 66 66m5 : 64 or 757777777 777 66 66 66 await y1 = 0 7577777 66 66 4 77777 66 66 m6 : y2 := 2 7777 66 66m7: critical 7575 64 64m8: t := 1 m9 : y2 := 0

Fig. 1.50. Program MUX-DEK-A (a variant of Dekker's algorithm).

Consider a version of rule WELL-J in which premise JW2 has been replaced by the weaker premise

d JW2.

^ 'i ! q0 _

_k

('0j ^ i < j0 ),

j =1 0 j ) _ (i = j0 ). This premise requires that either q is achieved by , or the rank does not increase and some assertion 'j (not necessarily 'i ) holds after the transition.

where i < j0 stands for (i

Show that the resulting rule is unsound. That is, show a property that d JW3, and JW4, over a given program, and yet is satis es premises JW1, JW2, invalid. This will show that persistence of helpful transitions is essential.

Problem 1.6 (integer division)

page 59 Program IDIV of Fig. 1.52 accepts two positive integers in variables x and y and places in variable z their integer quotient x div y, and in variable w the remainder of their division x mod y. Prove total correctness of program IDIV, which can be speci ed by the response formula ) (at `5 ^ x = z y + w ^ 0 w < y).

1

86


Chapter 1: Response

local y1 ; y2 ; t: integer where y1 = 0; y2 = 0; t = 1

3 2 `0 : loop forever do 377 66 2` : noncritical 66 6 1 77777 66 66`2: y1 := 2 66 66`3:2while y2 = 2 do 3777777 66 66 `4: if t = 2 then 7777 66 66 66 2` : y := 1 3777777 777777 66 66 66 6 5 1 7 ` : await t = 1 6 5 4 66 6 4 6 57777 7777 6 `7 : y1 := 2 66 6 7777 6 66 6`8: critical 7777 6 66 6` : t := 2 9 7777 6 66 6 ` : await y = 6 1 55 4 2 4 10 `11: y1 := 0

3 2 m0 : loop forever do 377 66 2m : noncritical 66 6 1 77777 66 66m2: y2 := 2 66 66m32: while y1 = 2 do 3777777 66 66 m4 : if t = 1 then 7777 66 66 66 2m5: y2 := 1 3777777 777777 66 66 66 6 7 m : await t = 2 6 4 5 66 6 4 6 57777 7777 6 m7 : y2 := 2 66 6 7777 6 66 6m8: critical 7777 6 66 6m : t := 1 9 7777 6 66 6 m : await y = 6 1 55 4 1 4 10 m11 : y2 := 0

Fig. 1.51. Program MUX-DEK-B.

This formula states that every computation of program IDIV terminates (i.e., reaches the terminal location `5 ) with values of z, w satisfying x = z y + w and 0 w < y.

in x; y : integer where x > 0; y > 0 local t : integer out z; w : integer where z = w = 0 `0 : t := x `1 : while t > 0 do `2 : if w + 1 = y then `3: (z; w; t) := (z + 1; 0; t 1) else `4 : (z; w; t) := (z; w + 1; t 1) `5 : Fig. 1.52. Program IDIV (integer division).


Problems

87

Problem 1.7 (greatest common divisor)

page 59 Program GCDM of Fig. 1.53 accepts two positive integers in variables x1 and x2. It computes in z the greatest common divisor (gcd ) of x1 and x2, and in variables w1 and w2 two integers which express z as a linear combination of the inputs x1 and x2. Prove total correctness of program GCDM, which can be stated by the response formula ) at `6 ^ z = gcd (x1 ; x2) ^ z = w1 x1 + w2 x2 :

1

in x1; x2 : integer where x1 > 0; x2 > 0 local y1 ; y2 ; t1; t2; t3; t4; u : integer out z; w : integer `0 : `1 : `2 :

(y1 ; y2 ; t1 ; t2 ; t3 ; t4 ) := (x1; x2; 1; 0; 0; 1) (y1 ; y2 ; u) := (y2 mod y1 ; y1 ; y2 div y1 ) while y1 6= 0 do " # `3 : (t1 ; t2; t3; t4) := (t2 u t1; t1; t4 u t3 ; t3 ) `4 : (y1 ; y2 ; u) := (y2 mod y1 ; y1 ; y2 div y1 ) `5 : (z; w1; w2) := (y2 ; t2 ; t3 ) `6 :

Fig. 1.53. Program GCDM(greatest common divisor with multipliers). The program uses the operation div of integer division and the operation mod which computes the remainder of an integer division. In your proof you may use the following properties of the gcd function which hold for every nonzero integers m and n (possibly negative): gcd (m; n) = gcd (m n; n) for every m 6= n gcd (m; m) = jmj.

Problem 1.8 (computing the gcd and lcm )

page 59 Program GCDLCM of Fig. 1.54 accepts two positive integers in variables x1 and x2. It computes in variable z their greatest common divisor and in variable w their least common multiple. Prove total correctness of program GCDLCM, which can be stated by the response formula ) at `7 ^ z = gcd (x1 ; x2) ^ w = lcm (x1; x2) :

1

88


Chapter 1: Response

in x1; x2 : integer where x1 > 0; x2 > 0 local y1 ; y2 ; y3 ; y4 : integer out z; w : integer `0 : (y1 ; y2 ; y3 ; y4 ) := (x1 ; x2; x2; 0) `1 : while y1 6= y2 do 3 2` : if y > y then 2 1 2 66 `3: (y1 ; y4) := (y1 y2; y3 + y4)77 75 64`4: if y1 < y2 then `5 : (y2 ; y3 ) := (y2 y1 ; y3 + y4 ) `6 : (z; w) := (y1 ; y3 + y4 ) `7 : Fig. 1.54. Program GCDLCM (computing the gcd and lcm ).

In your proof you may use the properties of the gcd function listed in Problem 1.7, and the following property of the lcm function: lcm (m; n) = m n=gcd (m; n).

Problem 1.9 (set partitioning)

page 59 Consider program EXCH presented in Fig. 1.55. The program accepts as input two sets of natural numbers S and T, whose initial values are S0 and T0 , respectively. Process P1 repeatedly identi es and removes the maximal element in S and sends it to P2 which places it in T. Symmetrically, P2 identi es and removes the minimal element in T and sends it to P1 which places it in S. The processes use the operations max(S) and min(T ) which nd, respectively, the maximal element in the set S and the minimal element in the set T . Show total correctness of program EXCH, which can be speci ed by the response formula ) (at `9 ^ at m7 ^ jS j = jS0 j ^ jT j = jT0 j ^ S T). This formula states that the program terminates and on termination, sets S and T have preserved their initial sizes and that every element in S is smaller than or equal to every element in T .

1

Problem 1.10 (converse of Claim 1.3) page 67 Let P :: [P1 :: S1 k kPk :: Sk ] be a program whose top-level processes communicate by shared variables and such that every program variable is owned by one


Problems

89

in S0 ; T0 : set of natural where S0 6= ;; T0 6= ; out S; T : set of natural where S = S0 ; T = T0 local ; : channel of integer

2local x; mx: integer 3 77 66`0: x := 1 7 66`1: mx := max(S) 66` : while x < mx do 777 66 2 2 3777 66 `3: ( mx 7 P1 :: 66 66`4 : S := S fmxg7777 7777 66 66`5: ) x 6 66 4`6: S := S [ fxg 7577 66 ` : mx := max(S) 77 77 66 7 5 4`8: ( 1 `9 :

2local y; mn: integer 3 7 66m0: ) y 66m1: while y 0 do 777 66 2m : T := T [ fyg 377 7 6 2 P2 :: 66 66m3 : mn := min(T) 7777 7777 66 66m4: ( mn 6 66 4m : T := T fmng7577 75 64 5 m7 :

m6 : ) y

Fig. 1.55. Program EXCH (partitioning two sets).

of the top-level processes. Let be a model such that the interpretation of is a subset of the locations of P and is simultaneously a modular computation of every Pi, i = 1; : : :; k. Show that is a computation of P.

Problem 1.11 (completeness of rule COMP-B) page 68 Let P :: [P1 :: S1 k kPk :: Sk ] be a program whose top-level processes

communicate by shared variables and such that every program variable is owned by one of the top-level processes. Let ' be a P-valid formula. Show that the P-validity of ' can be compositionally inferred from modular validities, using rule COMP-B and temporal reasoning. This establishes the completeness of rule COMP-B for compositional veri cation. A solution to this problem can be organized as follows. For each top-level process Pi, i = 1; : : :; k, construct a formula i capturing the temporal modular semantics of Pi. That is, a model satis es i i is a modular computation of Pi . Argue semantically that Pi m i , for each i = 1; : : :; k. Use rule COMP-B and temporal reasoning to infer

q

90


Chapter 1: Response

q

P 1 ^ ^ k. Argue semantically that a model satis es 1 ^ ^ k i is a computation of the entire program P. Therefore, if ' is P-valid, then the following general validity holds: 1 ^ ^ k ! '. Apply temporal reasoning to P 1 ^ ^ k and 1 ^ ^ k ! ' to infer P '.

q

q

q

q

c Z. Manna and A. Pnueli, 10 November 1996. Not for Distribution

Chapter 3: Response Under Fairness

147

Chapter 3

Response Under Fairness

Chapters 1 and 2 considered proof rules for response properties that depend on

justice for their validity. While justice is an important fairness requirement, it is

only one of the two fairness requirements listed in a general fair transition system. In this chapter we consider proof rules for response properties that depend on the two fairness requirements, i.e., justice and compassion , for their validity. In a way similar to Chapter 1, we rst introduce a single-step rule for response under compassion, and then introduce the fair versions of CHAIN and WELL. Let us review the basic phenomena that are modeled by the requirements of justice and compassion.

Justice

Justice represents a natural property of multi-processor systems. It represents the obvious intuition that parallel processes, implemented on separate processors, should progress independently as long as they do not need to synchronize with other processes. This intuitively obvious fact for multi-processor systems must be represented explicitly by justice in our model, due to the artifact of modeling concurrency by interleaving. Justice excludes from the set of computations runs in which an enabled process does not progress beyond some point. Consequently, justice represents in our model the natural phenomena of independent progress in parallel components of a multi-processor system. Since justice is associated with the general phenomenon of parallelism, it is not restricted to particular statements. In the computational model we consider here, all transitions, with two exceptions, are required to be just, i.e., are members of the justice set J . The exceptions are the idling transition I and the transition associated with the schematic noncritical statement.

Compassion


148


Compassion excludes from the set of computations runs in which one of the compassionate transitions is enabled in nitely many times but taken only nitely many times. In comparison with justice, compassion has a much narrower scope and is associated with only a small subset of statements and their corresponding transitions. A case in point is the semaphore request statement. We should bear in mind that a correct implementation of a semaphore which ensures the required compassion property must be based on either a nontrivial software protocol or a special hardware arbiter. For example, a protocol for semaphore services may place all requests in an internal queue, and allocate the semaphore on a rst-come- rst-serve basis. In our high-level programming language, all these low-level details are abstracted away and the whole transaction between customer and server is represented by the single statement request y. The compassion requirement associated with this statement provides an abstract representation of the internal queing mechanism, replacing the rst-come- rst-serve guarantee by the weaker in nitely-often-requested-eventually-served guarantee. We can view our extensive study of mutual exclusion algorithms that do not use semaphores as an investigation of ways to implement compassion using only justice. In fact, each of these algorithms can be used to implement a semaphore, which is the simplest manifestation of compassion. Another class of statements associated with compassion requirements are the communication statements. As in the case of semaphores, the compassion assumption provides a useful abstraction that hides a more involved low-level protocol that ensures fair arbitration between processes that compete for an access to a common channel. Compassion can also be used to model probabilistic behavior. Consider a program consisting of two processes that communicate over an unreliable channel. A probabilistic characterization of such a channel may specify, for example, that on the average it loses one message out of ten. This assigns a probability of 0.9 that a message sent will arrive on the other side. Assume that we have a protocol that overcomes the unreliability of the channel by repeatedly sending a message until it is acknowledged. To verify the correctness of such a protocol by the tools presented in this book, we replace the quantitative characterization A message submitted will get across with probability 0.9 by the compassion requirement A message submitted in nitely many times will eventually get across. Some examples presented in this chapter illustrate the use of compassion for modeling probabilistic behavior.


3.1 A Single-Step Rule

149

1

In most of the chapter, we consider the simpler case of response formulas p ) q, where p and q are assertions. In the last subsection of Section 3.7, we discuss the generalization to the case that p and q are arbitrary past formulas. In Section 3.1 we present a single-step rule that relies on the activation of a single compassionate transition. Section 3.2 shows how to combine several applications of the just and compassionate single-step rules into a chain rule that relies on a xed number of helpful transitions. We also introduce veri cation diagrams which provide a graphical representation of the chain rule. Section 3.3 illustrates applications of the chain rule under general fairness to example programs that involve message passing. Section 3.4 explores the use of compassion to model channels which are only eventually reliable, i.e., can only guarantee that a message that is repeatedly transmitted eventually gets through. Section 3.5 presents a well-founded rule for response under general fairness. Section 3.6 considers dierent proposed solutions to the dining philosophers problem. In the SAFETY book, we established the safety properties of these solutions. Here, we complete their formal veri cation by proving that most of those solutions satisfy the progress property of accessibility. In Section 3.7 we complete the formal veri cation of several resource-allocation programs considered in the SAFETY book, by establishing their response properties. Section 3.8 establishes the (relative) completeness of the well-founded rule introduced in Section 3.5 for proving all response properties of a given program. This section considers the special (but most prevalent) case of a formula p ) q where p and q are state formulas. Section 3.9 extends the completeness proof to the general case of a response formula p ) q where p and q are past formulas. Section 3.10 presents algorithms for automatic veri cation of response formulas p ) q over nite-state systems, for the case that p and q are state formulas. Finally, Section 3.11 completes the discussion of algorithmic veri cation of response properties by considering the general case where p and q are past formulas.

1 1


1


150


The rules based on justice, considered in Chapters 1 and 2, are not powerful enough to prove response properties based on compassion. To see this, consider the standard semaphore program for mutual exclusion, presented in Fig. 3.1. This program was rst introduced in Fig. 1.6 of the SAFETY book.

local y: integer where y = 1 2

3

`0 : loop forever do 2 3 6 6 `1 : noncritical 777 6 P1 :: 66 66`2 : request y 7777 6 77 6 4`3 : critical 55 4 `4 : release y

2

3

m0 : loop forever do 2 3 6 6 m1 : noncritical 777 6 P2 :: 66 66m2 : request y 7777 6 77 6 4m3 : critical 55 4 m4 : release y

Fig. 3.1. Program MUX-SEM (mutual exclusion by semaphores). The main response property associated with this program is individual accessibility. Stated for process P1, it is given by at `2 ) at `3 : | {z } | {z } p

1

q

The situation is very easy to analyze. Clearly, we can identify `2 as a helpful transition in this case, which obviously needs only one helpful step to achieve the goal at `3 . Let us consult rule RESP-J (Fig. 1.1), which is the strongest rule for single-step response properties we have. Premises J1{J3 of this rule are satis ed for ' = p: at `2 : `2 . That is, the helpful transition `2 leads from at `2 to at `3 , while all other transitions preserve at `2 . The premise we fail to prove is J4, which requires at `2 ! En (`2 ), or equivalently at `2 ! at `2 ^ y > 0. This, of course, is not a valid invariant for program MUX-SEM. Let us recall the reasons for including premise J4 in rule RESP-J. While premises J2 and J3 ensure that ' is preserved until q is achieved, and that the next -transition taken from a '-state achieves q, premise J4 forces, through justice,



151

that transition eventually will be taken. Justice guarantees the activation of only if is continuously enabled beyond some point. Since ' holds continuously until q is achieved, premise J4 ties the enableness of with ', ensuring that will be continuously enabled until q is achieved. If q is not achieved, will be continuously enabled and never taken, violating justice with respect to . Compassion is less demanding about the degree of enableness of that is required to ensure activation. For a compassionate transition , it is only necessary that be in nitely often enabled to guarantee its activation. Consequently, we may relax the tie between ' and the enableness of and, instead of requiring that is enabled whenever ' holds, only require that if ' holds then eventually should be enabled.

The Single-Step Rule Relaxation of the last premise leads to rule RESP-C for proving single-step response under compassion (Fig. 3.2). For assertions p, q, ', and transition h 2 C C1. p ! q _ ' C2. f'g T fq _ 'g C3. f'g h fqg C4. ' ) :' _ En (h ) p

1 )1

q

Fig. 3.2. Rule RESP-C (single-step response under compassion). Premise C1 requires that any p-position, that does not already satisfy q satis es the intermediate assertion '. Premise C2 requires that the application of any transition to a '-state yields a state satisfying q or '. Premise C3 requires that the application of the helpful transition h to a '-position yields a q-position. Premise C4, which distinguishes RESP-C from RESP-J, requires that if ' holds then eventually either ' will stop holding, or the helpful transition h will become enabled. Note that, due to C2 and C3, the rst transition that falsi es ' leads to a q-position. Consequently, C4 can also be written as ' ) q _ En (h ) :

1


152


Justi cation To justify the rule, consider a computation satisfying the four premises of the rule. Assume that p holds at some position k 0. We wish to show that q holds at some later position j k. Assume, to the contrary, that q never holds beyond k. By C1, ' also holds at k. By C2 and the assumption that q does not hold beyond k, ' holds continuously beyond k. Consider position i1 = k, at which ' holds. By C4, there exists a position j1 , j1 i1 , at which either ' is false or h is enabled. Since ' is true at all positions beyond k, h is enabled at j1 . Take i2 = j1 + 1. By C4, since ' also holds at i2 , there exists a position j2 , j2 i2 , at which, again, h is enabled. By repeating the argument we construct an in nite sequence of positions j1 < j2 < , at all of which h is enabled. Thus, h is enabled at in nitely many positions in . Transition h is not taken beyond k since, by C3, any application of h to a '-position results in a q-position, and by our assumption, there are no q-states beyond k. This violates the requirement of compassion with respect to h . Thus, q must hold at some position beyond k. In applications of the rule, it is sucient to check premise C2 for 6= h , since C2 for = h is implied by C3. It is easy to see that, for a transition h that is both just and compassionate, rule RESP-C is stronger than rule RESP-J. This means that the premises of rule RESP-J imply the premises of rule RESP-C. This is because the rst three premises of the two rules are identical, and due to the re exivity and monotonicity of the operator, J4. ' ! En (h ) implies C4. ' ) :' _ En (h ): On the other hand, rule RESP-C has a more limited applicability than rule RESP-J. In rule RESP-J we may choose any just transition to be the helpful one. Rule RESP-C is restricted to use only compassionate transitions, which form a much smaller set than that of the just transitions. In most applications of rule RESP-C premise C4 is established by proving the stronger statement c C4: ' ) En (h ), which obviously implies C4. Rule RESP-C appears to be recursive. To prove one response property, it uses as one of its premises another response property. How is this premise to be

1

1

1



153

proven? We will give several answers to this puzzling question, showing that such recursive rules do not necessarily lead to circular reasoning.

1

Example Let us use rule RESP-C to prove the accessibility property at `3 at `2 ) | {z } | {z } p q for program MUX-SEM of Fig. 3.1.

Take

' = p: at `2 h : `2 . This choice identi es `2 as the helpful compassionate transition. Premise C1 This premise requires at `2 ! _ |at{z`2} ; | {z } p

'

which is clearly valid. Premise C2 This premise is proven by showing ^ at `2 ! _ at 0 `2 | {z }

| {z }

'

'0

for any 6= `2 . Since while P1 is at `2 no other transition of P1 is enabled and no transition of P2 can aect at `2 , the premise follows. Premise C3 This premise requires `2 ! at 0 `3 ^ at 0 `3 ^ at | {z } {z

|

`2

}

'

| {z }

q0

which is obviously valid. Premise C4 This premise is established by proving at ` ) _ at ` ^ y > 0 : 2 2 | {z } | {z } '

1

En (`2 )

The proof of this response property using rule CHAIN-J is presented in the veri cation diagram of Fig. 3.3. In the proof we are aided by the invariant


154


F

C

at `2 ; y = 0

E D at m3

m3

at m4

m4

^ at `2

y>0

Fig. 3.3. Veri cation diagram for premise C4.

1: at `3;4 + at m3;4 + y = 1. Due to invariant 1 , if at `2 holds but y 0, then y = 0 and P2 must be at m3 or m4 . This concludes the proof of accessibility for program MUX-SEM. The example above provides a rst answer to the problem of recursiveness of rule RESP-C. In some cases, the temporal premise C4 can be proven by using the J-rules.

3.2 Chain Rule Naturally, after presenting a single-step rule for response under compassion, we should consider the compassionate version of rule CHAIN. Such a version can be obtained in the standard by considering a sequence of assertions '0 ; : : :; 'm _ way, 'j can be proven using rule RESP-C for each i = 1; : : :; m. such that 'i )

1

j

The conclusion of such a rule is

m _

i=0

'i )

1

'0 .

However, this version is not very useful. When tracing a chain of helpful steps, it is rarely the case that all of them are associated with compassionate transitions. The typical case is that most of the helpful steps are due to just transitions while


3.2 Chain Rule

155

only one or two are due to compassionate transitions. Consequently, rule CHAIN-F presented in Fig. 3.4 allows both just and compassionate helpful transitions. For assertions p and q = '0 ; : : :; 'm and transitions 1 ; : : :; m 2 J [ C F1. p !

m _

'j

j =0

F2. f'i g T F3. f'i g i

_

j i _

j

'j 'j

1

F4. If i 2 C , then C4. 'i ) :'i _ Otherwise J4. 'i ! En (i ) p )

1

9 > > > > > > > > > > > > > > = > > > > > > > En (i ) > > > > > > > ;

for i = 1; : : :; m

q

Fig. 3.4. Rule CHAIN-F (chain under fairness). Premises F1{F3 of rule CHAIN-F are identical to the corresponding premises J1{J3 of rule CHAIN-J (Fig. 1.7). Premise F4 of rule CHAIN-F requires either eventual or immediate enableness, according to whether i is compassionate or only just. Note that if i is compassionate, we may still attempt to prove for it the simpler (and stronger) version of F4, i.e., 'i ! En (i ), because this implication obviously implies 'i ) :'i _ En (i ) . Only if we fail to prove the simpler version, should we resort to a direct proof of the more complex version.

1

Justi cation The justi cation of rule CHAIN-F is similar to that of rule CHAIN-J. Assume a computation in which p holds at position k and no position beyond k satis es q. From premises F1{F3 it follows that there exists a position r k and an index i > 0 such that 'i holds continually beyond r and no 'j , with j < i, holds at any such position.


156


Consider two cases. If i , the helpful transition for 'i , is compassionate then by F4, i is enabled in nitely many times. It follows that does not ful ll the requirement of compassion with respect to i , contradicting the assumption that is a computation. If i is just but not compassionate, F4 implies that it is continually enabled which shows that violates the requirement of justice with respect to i . We conclude that the described situation is impossible, and every p-position must be followed by a q-position. In applications of the rule, it is sucient to establish premise F2 for all 6= i , since F2 for = i is implied by premise F3.

Example (producer-consumer)

We illustrate rule CHAIN-F on program PROD-CONS, presented in Fig. 3.5. This program was rst introduced in Fig. 2.23 of the SAFETY book. The response property we wish to establish for this program is accessibility, which for process Prod is given by at `2 ) at `4 : | {z } | {z } p

1

q

In the proof, we are aided by the following invariants 0: r 0 ^ ne 0 ^ nf 0 1: r + at `4;5 + at m3;4 = 1 2: ne + nf + at `3::6 + at m2::5 = N. To prove the accessibility property we use rule CHAIN-F. Inspecting the program, it is easy to identify the intermediate stages in the progress from `2 to `4 . We choose '2: at `2 2 : `2 '1: at `3 1 : `3 '0: at `4 : It is straightforward to verify that each i , i = 1; 2, leads from 'i to 'i 1 , and that being at 'i , each transition , 6= i preserves 'i . The only nontrivial premises to verify are the enableness premises F4 for i = 1; 2. In this case both 1 and 2 are compassionate transitions, so we should prove eventual enableness. Premise F4 for i = 2 For this premise it suces to prove


3.2 Chain Rule

157

local r; ne ; nf : integer where r = 1; ne = N; nf = 0 b : list of integer where b = 3 local x: integer 6` : loop forever do 7 7 6 0 6 37 2 6 `1 : produce x 77 6 6 6` : request ne 77 77 Prod :: 666 66 2 77 ` : request r 77 6 3 6 77 6 2

6 6 6 4

6 `4 : 6 4 `5 :

b := b x release r

`6 : release nf

77 77 57 5

3

2

local y: integer 7 6 7 6m0 : loop forever do 6 37 2 7 6 m : request nf 1 7 6 7 6 7 6 m : request r 7 6 2 7 Cons :: 66 66 77 m : (y; b) := hd (b); tl (b) 77 6 3 6 77 6 6 77 6m4 : release r 6 77 6 6 57 4m5 : release ne 5 4 m6 : consume y Fig. 3.5. Program PROD-CONS (producer-consumer).

at `2 ) | {z } '2

1

_ |at `2 ^{z ne > 0} : En (`2 )

To prove this response property we use rule CHAIN-J. The proof is presented in the CHAIN diagram of Fig. 3.6(a). Note that we use the invariant ne 0 to infer that if ne 0 then in fact ne = 0. Invariant 2 is used to deduce that, when ne = 0 and at `2 ^ at m1 holds, then nf = N > 0. Invariant 1 is used to deduce that, when at `2 ^ at m2 holds, then r = 1 > 0. An interesting point is that, even though m1 and m2 are compassionate transitions, we included them in a proof by rule CHAIN-J. This is possible because, under the assumption that P1 is frozen at `2 and ne = 0, these transitions are immediately enabled when control is at their respective locations.


158

F

at `2 ; ne = 0

C

E D at m6 m6


at m0 m0

at m1 ^ nf > 0 m1 at m2 ^ r > 0 m2 at m3 m3 at m4 m4 at m5 m5

^ at `2

ne > 0

(a) Proof of premise F4 for i = 2.

F

at `3 ; r = 0

E D at m3

m3

at m4

m4

^ at `3

This premise is proven by showing

r>0

(b) Proof of premise F4 for i = 1.

Fig. 3.6. CHAIN diagrams.

Premise F4 for i = 1

C


3.2 Chain Rule

159

1

at `3 ) | {z } '1

_ |at `3 {z^ r > 0} : En (`3 )

The proof is based again on an application of rule CHAIN-J, and is presented in the CHAIN diagram of Fig. 3.6(b). We use the invariant r 0 to infer that if r 0 then r = 0. Then, we use 1 to deduce that if r = 0 and P1 is at `3 , then P2 can only be at m3 or at m4 . This concludes the proof of the accessibility property at `2 ) at `4 . In Problem 3.2, we request the reader to prove that the accessibility property is valid even over a weaker version of the program, in which the transitions corresponding to the semaphore request statements, are taken to be just, rather than compassionate.

1

CHAIN-F

Diagrams

Diagrams can also be used to provide a concise representation of a proof by rule CHAIN-F. The main extension over CHAIN diagrams is the introduction of a third type of an edge | a solid edge, where a solid edge will correspond to a helpful transition which is compassionate. Consequently, edges connecting nodes (assertions) in a diagram can be single (-line), double, or solid. CHAIN-F Diagrams

A veri cation diagram is said to be an CHAIN-F diagram if its nodes are labeled by assertions '0 ; : : :; 'm with '0 being the terminal node, and if it satis es the following requirement: If a single edge connects node 'i to node 'j , then i j. If a double or a solid edge connects 'i to 'j , then i > j. Every node 'i , i > 0, has at least one departing edge which is either double or solid. The transition labeling this edge is identi ed as helpful for assertion 'i .

Veri cation Conditions for CHAIN-F Diagrams Let ' be a nonterminal node and '1 ; : : :; 'k , k 0, be the -successors of '. If labels a single edge, we associate with ' and the veri cation condition f'g f' _ '1 _ _ 'k g. If labels a double or solid edge, we associate with ' and the veri cation condition


160


f'g f'1 _ _ 'k g.

If labels a double edge departing from ', we associate with ' and the

requirement ' ! En (). If labels a solid edge departing from ', we associate with ' and the response formula ' ) :' _ En (): We extend the notion of veri cation conditions to include also the enabling requirement associated with double edges and the response formulas associated with solid edges.

1

Valid CHAIN-F Diagrams

A CHAIN-F diagram is said to be P-valid if the rst three types of veri cation conditions associated with its nodes and transitions are P-state valid, and the response formula conditions, associated with solid edges, are P-valid. The consequences of having a valid CHAIN-F diagram are stated in the following claim.

Claim 3.1 (fair chain)

A P-valid CHAIN-F diagram establishes that the response formula m _

j =0

'j )

1

'0

is P-valid. If, in addition, we can establish the following implication: p !

m _

j =0

'j

'0 ! q

and

1

then we can conclude the P-validity of p ) q.

Example (producer consumer)

The proof of the accessibility property of program PROD-CONS (Fig. 3.5) can be represented by the CHAIN-F diagram at `2

`2 7.6(a)

-

at `3

`3 7.6(b)

-

at `4


3.2 Chain Rule

161

Since each transition labeling a solid edge needs a subproof that establishes the validity of the compassionate version of premise F5, we often attach a reference to such edges, which points to the diagram for the subproof. Thus, in the above diagram, we referred to CHAIN diagram 3.6(a) as establishing the eventual enableness of `2 , and to CHAIN diagram 3.6(b) as establishing the eventual enableness of `3 .

Example (multiple resource acquisition)

In Fig. 2.12 of the SAFETY book we introduced program RES-3 as an example of a program consisting of several processes that need several resources in order to perform their critical activity. We reproduce this program in Fig. 3.7.

local r1; r2; r3: integer where r1 = r2 = r3 = 1 2

3

`0 : loop forever do 37 2 6 7 6 ` : noncritical 1 6 6` : request (r ; ` ): request r 77 7 6 P1 :: 6 6 2 2 3 37 77 6 6 57 4`4 : critical 5 4 `5 : release (r2; `6 ): release r3 2

3

m0 : loop forever do 2 37 6 6 7 m : noncritical 1 6 7 6 7 6 P2 :: 6 6m2 : request (r1; m3 ): request r3777 6 77 6 4m4 : critical 55 4 m5 : release (r1; m6 ): release r3 2

3

k0: loop forever do 37 2 6 7 k1: noncritical 6 7 6 P3 :: 66 66k2: request (r1; k3): request r27777 77 6 6 55 4k4: critical 4 k5: release (r1; k6): release r2 Fig. 3.7. Program RES-3 | three processes needing three resources.


162


In Section 2.3 of the SAFETY book, we established the safety property of mutual exclusion for program RES-3. The proof was based on the following invariants 0: r1 0 ^ r2 0 ^ r3 0 1: r1 + at m3::5 + at k3::5 = 1 2: r2 + at `3::5 + at k4::6 = 1 3: r3 + at `4::6 + at m4::6 = 1. It is easy to see that these invariants ensure pairwise exclusion between the processes. For example, to show exclusion between P1 and P3, we examine the invariant 2 , corresponding to the resource r2 common to P1 and P3 . From 0 and 2 we obtain at `4 + at k4 at `3::5 + at k4::6 1, which shows that P1 and P3 cannot be at their critical sections at the same time. Here we prove the response property of accessibility. Stated for P2 , it is given by at m2 ) at m4 A proof of this property by rule CHAIN-F is presented in the following diagram

at m2

1

m2 Lemma 1

-

at m3

m3 Lemma 2

-

at m4

To complete the proof we need to show the enableness premise for m2 and m3 , which is done in Lemmas 1 and 2.

Lemma 1

at m2 )

1

(at m2 ^ r1 > 0)

Examining invariant 1 we see that, with P2 being at m2 , the only way for r1 to be nonpositive is that r1 = 0 and P3 is at k3::5. We therefore have to follow P3 until it exits k3::5, at which point k5 sets r1 back to 1. This development is shown in the CHAIN-F diagram of Fig. 3.8. Of the three helpful transitions identi ed in this diagram, immediate enableness of k4 and k5 follows from assertions at k4 and at k5 respectively. The situation is dierent with k3 which also needs r2 > 0 to proceed. Since k3 is a compassionate transition, it is sucient to prove eventual enableness, which is proven in Lemma 1.1.

Lemma 1.1

at m2 ^ at k3 ^ r1 = 0 )

1

(at k3 ^ r2 > 0) Examining invariant 2 , we see that with P3 at k3, the only way for r2 to be nonpositive is that r2 = 0 and P1 is at `3::5. The diagram of Fig. 3.9 follows P1


3.2 Chain Rule

F E

at m2 ; r1 = 0 at k3

k3 Lemma 1.1

-

at k4

k4

163

C

D

at k5

k5

at m2 ; r1 > 0

Fig. 3.8. CHAIN-F diagram for Lemma 1.

until it executes `5 , at which point r2 becomes positive. Notice that since P2 is waiting at m2 with r1 = 0, and P3 is waiting at k3 with r2 = 0, they are both disabled, and the only process that can save the day is P1. The CHAIN diagram of Fig. 3.9 shows that indeed it does.

F E

at m2 ; at k3; r1 = r2 = 0 at `3 ; r3 > 0

`3

at `4

`4

C

D

at `5

`5

at k3 ; r2 > 0

Fig. 3.9. CHAIN diagram for Lemma 1.1. Note that due to 3 , while P1 is at `3 and P2 is at m2 , r3 is positive, which makes `3 immediately enabled. Thus, even though `3 is a compassionate transition we can prove for it immediate enableness.

Lemma 2

at m3 )

1

(at m3 ^ r3 > 0)

This lemma proves the second enableness premise for the accessibility property. While P2 is at m3 , the only way for r3 to be nonpositive, according to 3, is that r3 = 0, and P1 is at `4::6. The CHAIN diagram of Fig. 3.10 traces the progress of P1 through `4::6 until transition `6 increases r3 to 1.


164

F E

at m3 ; r3 = 0 at `4


`4

at `5

`5

C D

at `6

`6

at m3 ; r3 > 0

Fig. 3.10. CHAIN diagram for Lemma 2.

This concludes the proof of the lemmas, and establishes accessibility for P2. Similarly, we can establish accessibility for P1 and P3 .

Recursiveness of the Fair Rules The proof of accessibility for P2 in the example above provides a second answer to the problem of recursiveness of the F-family of rules. The recursiveness problem is that the enableness premise of the F-rules is a response formula, similar to the conclusions of these rules. The question, therefore, is how we escape circular reasoning trying to prove a formula using a rule in which one of the premises is not simpler than the conclusion. The rst answer we gave, which is also illustrated in the proof of Lemma 1, is that to prove a property by an F-rule, it is often possible to prove its eventual enableness premise F4 by J-rules. For example, the enableness premise for k3, needed in the proof of Lemma 1, is proven in Lemma 1.1 by rule CHAIN-J (Fig. 3.9). The second answer, which is illustrated in the complete proof of the accessibility property, is that even if we need to pursue several levels of proof, all of which use an F-rule, we are guaranteed that on each level we have to consider one process less than on the previous level. Consider the proof of the accessibility property for program RES-3. It is mainly based on the progress of P2 from m2 to m4 . To complete the proof we need at m2 an enableness premise that guarantees that the transition m2 eventually becomes enabled. If it happens to be currently enabled, all the better. So the dicult case is to show that if P2 is at m2 and the transition at m2 is currently disabled , it eventually becomes enabled. For that we use Lemma 1. However, note that in all the subsequent situations considered in Lemma 1 or any of its subproofs, P2 is disabled. This implies that, when dealing with this


3.3 Compassion in Message Passing

165

case, we have one less process to consider. Lemma 1, recursively, uses an F-rule to follow the progress of P3 from k3 to k6. In all situations arising throughout this progress, P2 is continuously neutralized (frozen). Considering the situation of P3 at k3 , we realize that the proof of another eventual enableness is called for, namely the eventual enableness of k3 . For that we use Lemma 1.1. Since the interesting case for Lemma 1.1 is when k3 is disabled, we enter this lemma with the assumption that two processes, P2 and P3 are disabled. Thus, Lemma 1.1 has only process P1 to work with. And P1 better help itself for all the enableness properties it needs, since P2 and P3 are paralyzed and cannot oer any help. In general, a recursive rule or procedure is acceptable if we can identify a well-founded measure that decreases on any recursive invocation. The discussion above identi es this measure, in our case, as the number of processes which are still potentially enabled, since any additional level in the proof tree freezes an additional process. It is obvious that, when we reach a single remaining process, the property is valid only if it can be proven by the J-rules, since no other process is available to eventually improve the enableness status of transitions.

3.3 Compassion in Message Passing The previous section considered compassionate transitions associated with semaphore statements. Here we consider communication statements, which are the other statements associated with compassion requirements. We present several examples of programs that use message passing and analyze their response properties, using rules RESP-C and CHAIN-F. As examples, we present two algorithms for coordinating mutual exclusion by message passing which are based on compassion. We analyze these algorithms, and verify that they guarantee exclusion and individual accessibility.

Synchronous Message Passing

The rst algorithm we consider is program MUX-SYNCH of Fig. 3.11. The program consists of two customer processes P1 , P2, and an arbiter process A. The arbiter process accepts requests for entering the critical section from both processes. These requests are represented by T-messages on channels 1, 2 . The arbiter chooses nondeterministically to communicate with one of them. This communication grants the selected customer process a permission to enter its critical section. After the customer exits from its critical section it returns this permission by sending an F-message on its -channel to the arbiter that keeps waiting at k2 or k3, respectively, for this releasing communication. We start by considering mutual exclusion. This can be established by the


166


local 1; 2 : channel of boolean 2

3

`0 : loop forever do 3 2 6 6 `1 : noncritical 777 6 P1 :: 66 66`2 : 1 ( T 7777 77 6 6 55 4`3 : critical 4 `4 : 1 ( F 3 local y: boolean 7 6k : loop forever do 7 6 0 37 2 6 a 7 6 k : ) y; k : ) y A :: 6 2 1 1 1 7 77 6 6 or k : 5 4 1 5 4 k1b : 2 ) y; k3: 2 ) y 2

2

3

m0 : loop forever do 37 2 6 7 6 m : noncritical 1 7 6 7 6 6 P2 :: 6 6m2 : 2 ( T 777 77 6 6 55 4m3 : critical 4 m4 : 2 ( F Fig. 3.11. Program MUX-SYNCH (mutual exclusion by synchronous communication).

following invariants 1: at `3;4 $ at k2 2: at m3;4 $ at k3. From 1 and 2 we can infer the invariant :(at `3;4 ^ at m3;4), based on process A's inability to be simultaneously at k2 and at k3. Next, we prove accessibility for P1 . Accessibility for P1 is stated by


3.3 Compassion in Message Passing at `2 ) | {z } p

1

167

at `3 : | {z } q

It calls for a single application of rule RESP-C with ' = p: at `2 h : h`2 ; k1a i. It is obvious that premises C1, C2, and C3 hold for this choice. Needing more attention is premise C4 requiring ` ) _ at ` ^ at k : 1: at 2 2 1 | {z } | {z }

1

'

En (h`2 ;k1a i)

This property is proved by rule CHAIN-J as shown in the CHAIN diagram of Fig. 3.12.

F F E E

at `2

at k3

at m3

m3

at m4

hm4 ; k3

C

C i

D D

^ at k0

k0

at `2

at k1

Fig. 3.12. CHAIN diagram for 1 . The proof uses invariant 1 to infer that when P1 is at `2 , A cannot be at k2, and invariant 2 to infer that when A is at k3, P2 can only be at m3 or at m4 . Accessibility for P2 is proven in a completely symmetric way.

Asynchronous Message Passing

Program MUX-ASYNCH of Fig. 3.13 coordinates mutual exclusion by using asynchronous communication. The program uses channels which allow many readers but only one writer. The arbiter process A starts by loading channel with a single message, representing a permission to enter the critical section. The customer processes P1 and P2 compete on this single permission at locations `2 and m2 , respectively.


168


local ; 1 ; 2 : channel [::] of boolean local x1 : boolean 3 6` : loop forever do 7 7 6 0 2 37 6 6 ` : noncritical 77 P1 :: 66 6`1 : ) x 77 6 2 1 77 6 6 77 6 4`3 : critical 55 4 `4 : 1 ( T 2

3 local y: boolean 7 6k : loop forever do 7 6 0 37 2 6 7 6 k : ( T 1 A :: 666 66 2ka : ) y 377777 2 1 6 7 6 77 6k : 6 7 6 or 57 4 2 55 4 4 b k2: 2 ) y 2

local x2 : boolean 3 6m : loop forever do 7 7 6 0 37 2 6 7 6 m : noncritical 7 P2 :: 66 6m1 : ) x 77 77 6 2 2 6 77 6 6 55 4m3 : critical 4 m4 : 2 ( T 2

Fig. 3.13. Program MUX-ASYNCH (mutual exclusion by asynchronous communication).

Whoever succeeds in reading the message from channel proceeds to enter the critical section. On nishing, this process sends back a release message via 1 or 2 , respectively. Meanwhile, process A keeps waiting at k2 to collect this release message. On receiving the message, process A loops back and reloads channel with a new permission. To prove exclusion, we establish the invariant


3.4 Compassion in Message Passing

169

1: at k0;1 + jj + at `3;4 + at m3;4 + j 1 j + j 2 j = 1. Clearly, this invariant implies that at `3;4 + at m3;4 1. Accessibility for P1 is expressed by at `3 : at `2 ) | {z } | {z }

1

p

q This can be proven by rule RESP-C, taking

' = p: at `2 h : `2 . The rst three premises C1{C3 obviously hold. It only remains to show premise C4, the eventual enableness of `2 . This is expressed by ) _ at ` ^ j j > 0 : ` 2 2: at 2 | {z } | {z } '

1

En (`2 )

A CHAIN-J proof of this property is presented in the CHAIN diagram of Fig. 3.14. The proof uses invariant 1 to infer that when jj = 0 then either A is at k0;1, or it is at k2 with j 2j = 1, or at k2 with j 2j = 0 and P2 at m3;4.

F Fj j

at `2 ; jj = 0

C

C

E D # " ! E D at k2; 2 = 0 at m3

m3

at m4 m4

at k2 ^ j 2 j = 1

k2b

at k0

k0

at k1

k1

^

j j at `2

>0

Fig. 3.14. CHAIN diagram for 2 .


170


3.4 Modeling Eventual Reliability The preceding sections used compassion as an abstraction for a protocol that is implemented either by special hardware or by a software procedure. Our two main examples were semaphore and communication statements. There are additional contexts and applications where compassion provides a useful abstraction. We introduce here one such application, in which compassion is used to model eventual reliability of a hardware component of the system.

Modeling Faulty Channels

Consider program REL-TRANS of Fig. 3.15. This program consists of process P1 that sends messages 1; 2; : : : on channel , and process P2 that reads these messages from channel into y.

local : channel [1::] of integer local x: integer where x = 03 7 6` : loop forever do 7 6 0 " # 7 6 2

P1 ::

6 4

`1 : x := x + 1 `2 : ( x

7 5

2

3

local integer y 6 P2 :: 4m0 : loop forever do75 m1 : ) y

Fig. 3.15. Program REL-TRANS (reliable transmission). It is a simple matter to verify that y assumes the values 1; 2; : : : . Such veri cation depends, however, on the implicit assumption that channel is reliable. This assumption is re ected in the de nition of the transitions associated with the communication statements. For program REL-TRANS, these de nitions imply that execution of `2 : ( x appends x to the end of list , and the message remains in until removed by execution of m1 : ) y. In some cases, we may wish to study situations in which channel is not reliable and may either lose some messages or transmit them with corrupted values. There are two possible approaches to modeling such faulty channels. The rst approach associates with communication statements over faulty channels dierent types of transitions. These transitions should represent the potentially faulty behavior of such channels. Another approach, which is the one adopted here, is not to change the association of transitions to communication statements but to modify the program,


3.4 Modeling Eventual Reliability

171

replacing each send statement by an appropriate selection statements. We will illustrate this approach for two types of faults.

Modeling Lossy Channels

The rst fault we model is that of a channel that may lose some of its messages. Program LOSSY-TRANS of Fig. 3.16 represents a modi ed version of program REL-TRANS, which takes into account the possibility of lost messages.

local : channel [1::] of integer 2

local x: integer where x = 03 6` : loop forever do 7 6 0 7 2 3 P1 ::

6 6 6 6 6 6 6 4

`1 : x := x + 1 37 2 g 6 6 7 ` : ( x 2 6 77 6` : 6 57 4 2 4 or 5 s `2 : skip

7 7 7 7 7 7 7 5

2

3

local integer y 6 P2 :: 4m0 : loop forever do75 m1 : ) y

Fig. 3.16. Program LOSSY-TRANS (transmission with lossy channels). Program LOSSY-TRANS is obtained by replacing statement `2 : ( x of program REL-TRANS by the selection statement [`g2: ( x] or [`s2 : skip]. This implies that, whenever process P1 is ready to send x over channel , there is a nondeterministic choice between taking the good transition `g2 which actually sends x on , or taking the skip transition `s2 which does nothing and models a loss of the message. Thus, computations of program LOSSY-TRANS faithfully represent the situation that some messages are lost, and therefore y may assume only a subset of the values 1; 2; : : : . Such a transformation is intended tog model operations on an abstract faulty asynchronous channel b. Taking either `2 or `s2 represents sending x on b: Taking g `2 represents a successful transmission on b, while taking `s2 represents a loss of a message. Transition m1 represents receiving a message from b. It is important to realize that the faulty channel b modeled by this transformation is eventually reliable . This means that, if in nitely many messages are sent, channel b cannot lose all of them from a certain point on. This excludes computations in which in nitely many messages are sent on b but all but nitely many of them are lost.


172


Eventual reliability of our model follows from the requirement of compassion for the communication statement `g2 : ( x. If P1 attempts to send a message in nitely many times (i.e., visits `2 in nitely many times), then transition `g2 is enabled in nitely many times and, by compassion, must eventually be taken. It follows that, eventually, some x will be placed on channel , and process P2 will read it.

Modeling Corrupt Channels

Another type of fault that may be displayed by unreliable (but eventually reliable) channels is corruption of messages. This fault transmits a sent message but corrupts its value. In program CORR-TRANS of Fig. 3.17 we model a channel that may lose some messages and corrupt some of the others but eventually also transmits some correct messages. The selection statement in `2 contains three substatements. Statement `g2 represents faithful transmission; `s2 represents a loss of a message; and statement `c2 represents transmission of a corrupted value: 0 instead of x.

local : channel [1::] of integer local x: integer 6 where x = 0 6 6`0 : loop forever do 6 2 P1 ::

2

3

6 6 6 6 6 6 6 6 6 6 6 4

7 7 7 37 x + 1 3 77 77 x77777 7 77 7 77 7 777 777 777 557 5

`1 : 2x := `g2 : (

6 6 6 6 6 6 6`2 : 6 6 4

6 6 6 6`s : 6 2 6 4

or skip or `c2 : ( 0

P2 ::

2

3

6 6 6 6 4

7 7 37 7 7 77 55

local integer y 6m : loop forever do 6 0 2 m1 : y := 0

6 4m2 :

while y = 0 do m3 : ) y

Fig. 3.17. Program CORR-TRANS (transmission with corrupting channels). The receiving process P2 in this program is aware of the possibility of corruption, and is programmed to keep receiving until it gets a nonzero message. Again, due to compassion, the modeled channel is eventually reliable, excluding computations in which, from a certain point on, all messages are either lost or corrupted. Note, that a side eect of this modeling is that it also implies that some messages must eventually be correpted.



173

This approach to modeling faulty channels is also applicable to synchronous communication, using the same transformations.

Example (alternating bit protocol)

Consider program ALTER of Fig. 3.18. This program is designed to ensure reliable communication over a faulty channel. We assume a particular type of fault, by which each message is either transmitted intact or corrupted in a noticeable way, i.e., no messages are lost. The program uses synchronous channel trans to transmit messages from P1 to P2, and synchronous channel ack to send acknowledgements from P2 to P1. Each message sent over channel trans is a record with three components: pt , d, and ct . As we will see, pt serves as an identi cation of the message, d is the data that should be reliably transmitted from P1 to P2, and ct is a boolean eld indicating whether the message has been transmitted correctly (correct transmission) or corrupted by the faulty channel. A message sent over channel ack is also a record with the two components pa and ca . Field pa identi es the message that is acknowledged. Boolean eld ca indicates whether the message is transmitted correctly (correct acknowledgement) or corrupted. The possibility of corruption of a transmitted message is represented in Fig. 3.18 as a nondeterministic but fair (due to compassion) choice of transmitting the intended message with an additional bit of either T or F value. The choice of T for the additional bit represents a successful transmission, and then the other elds of the message are reliably valid. The case of F for the added bit, represents a failed transmission, in which the other elds of the message are unreliable, except for the F bit which identi es the message as a corrupt one. It is important to realize that Fig. 3.18 contains a mixture of a program for the protocol and additional transitions such as `c1 and mc4 , which model the potentially erratic behavior of the eventually reliable channels. The protocol, which is the program that will run in an actual application, has the statements

`1 : trans ( S; X[i]; T m4 : ack ( hR; Ti at locations `1 and m4 . The selection statements appearing at these locations in Fig. 3.18 are intended to model the behavior of trans and ack as eventually reliable channels.

The Protocol

The main idea in the protocol is that it maintains an acknowledgement channel, called ack , in which the receiver reports whether the message has arrived correctly, or has been corrupted. In both cases, the message in the ack channel is a request for a next transmission. In the case that the last message has been correctly received, the request is for the next message. In the case that the last


174


in X : array [1::] of integer local i; j : integer where i = j = 1 s; r; S; R; gt ; ga : boolean where S = R = T trans : channel of hpt : boolean; d: integer; ct : booleani ack : channel of hpa : boolean; ca : booleani out Y : array [1::] of integer 2

3

2

3

`0 : loop forever do 3 2 6 2 g

3 7 7 6 ` : trans ( S; X[i]; T 7 6 1 7 6 6 777 6` : 6 6 or 5 4 1 77 6 7 6 c : trans ( h ; ; Fi 7 P1 :: 66 66 ` 77 1 77 6 6 77 6 6 77 6`2 : ack ) hr; ga i 6 77 6 6 57 4`3 : if ga ^ r 6= S then 5 4 `4 : (i; S) := (i + 1; :S) m0 : 2loop forever do

37 6 6 7 m : trans ) s; Y [j]; gt 1 6 6 77 6 6m2 : if gt ^ s = R then 77 6 6 77 6 6 77 m : (j; R) := (j + 1; : R) 6 3 P2 :: 6 66 2 77 3 77 g 6 6 77 m : ack ( h R; T i 6 4 6 77 6 7 6 6m : 4 or 77 6 5 4 4 57 4 5 c m4 : ack ( h ; Fi Fig. 3.18. Program ALTER (alternating bit protocol with synchronous communication).

message has been incorrectly received, the request is for a retransmission of the last message. Corruption is also possible in the acknowledgement message. Consequently, it can be that the last message has been correctly received, but the sender is unaware of this fact, and keeps retransmitting the old message until a correct acknowledgement arrives. This possibility is also handled by the protocol. The interesting point about this protocol is that, under the above assumptions about the characteristics of the fault, only one bit of information, represented by a boolean value, is necessary to identify whether the sender is transmitting the



175

old message or a new message, and whether the receiver is asking for a transmission of a new message or for retransmission of an old one.

The Parity Bit

It is possible to consider a simpler but less space-ecient algorithm in which elds pt and pa contain the full sequence number of the message with each message and each acknowledgement, i.e., i and j, respectively. In this simpler algorithm, the receiver knows immediately which message it is receiving, and the sender immediately recognizes which message is being acknowledged. However, since messages are transmitted and acknowledged in sequence, and none are lost (by assumption), it is clear that the possibilities for confusion about which message is being transmitted or acknowledged are limited and can be resolved by one bit. When P2 is awaiting message X[j], and some message is successfully received, it can either be X[j] or X[j 1]. Similarly, when P1 is awaiting a request for i + 1 (which indirectly acknowledges message i), it can receive a request either for i + 1 or for i. The latter is a request for a retransmission of the old message. Therefore, it is sucient to enclose with each message the parity bit of the full sequence number (T for odd numbers, F for even ones). This will resolve the ambiguity between j and j 1, and between i + 1 and i. Indeed, initially i = j = 1 and the corresponding parity bits, S in P1 (the sender parity bit) and R in P2 (the receiver parity bit) are both T. Process P1, when sending X[i], includes S with it, which is the parity bit of i. When P2 receives a message in m1 , it checks at m2 for corruption and whether the sequence number of the received message, represented by its parity bit, matches P2's expectations of receiving X[j]. If the message is not corrupt (gt = T) and the received parity bit matches R, then this is the expected message. Consequently, both j and R are advanced in m3 to the next sequence number and its corresponding parity bit. Otherwise j and R retain their old values. Next, P2 sends in m4 a request for the next transmission which names X[j] as the requested message. This is represented by sending R, the parity bit of j. In the case j has not been advanced, this is a request for retransmission of X[j]. In case j has been advanced, this is a request for the next message. In `2 , P1 reads this request. In `3 it checks for a correct reception of the request message, and whether the request is for the next message, tested by r 6= S. If it is a request for a new message, then both i and S are advanced in `4 . Otherwise they stay the same.

A Safety Property

An appropriate safety property we wish to establish is that Messages approved by the receiver are identical to the original mes-


176


sages sent by the sender. For convenience, we have represented the list of messages transmitted by the sender as an input array X, and the list of messages approved by the receiver as an output array Y . These arrays are not an integral part of the algorithm, and are only used for the purpose of the speci cation and veri cation of the program. The main assertion, whose invariance implies the safety property described above, is 1: Y [1::j 1] = X[1::j 1]. This assertion states that the segment of the array Y consisting of positions 1; : : :; j 1 is identical to the corresponding segment of the array X. Since at any point in the program for P2 , j denotes the sequence number of the message that P2 attempts to receive, we can assume that it has already approved all the preceding messages, currently stored in Y [1::j 1]. The proof of invariant 1 uses the following auxiliary invariants: I1 : (S = R ^ i = j) _ (S 6= R ^ i + 1 = j) I2 : at `3 ^ ga ! r = R I3 : at m2 ^ gt ! s = S I4 : at `4 ! S 6= R I5 : at m3 ! S = R I6 : at `2 $ at m2::4. In Problem 3.1, the reader is requested to prove the invariant 1. An alternative proof of invariant 1 may be based on the assertion diagram of Fig. 3.19 which summarizes the states that may appear in a computation of program ALTER.

Proving Progress

As previously explained, the nondeterministic selections at `1 and m4 are not statements that actually exist in the protocol, but are intended to represent the unreliability of channels trans and ack . They present the possibility that instead of receiving a good record, containing hS; X[i]; Ti as prepared by P1, process P2 may receive a faulty record with unpredictable values for the rst two elds. The only alleviating assumption we make is that P2 can recognize whether it has received a valid or faulty message. This is represented by the last eld in the message, which is T for a valid message and F for a faulty one. The same assumptions are made about channel ack , which explains the nondeterministic selection at m4 . The main response property that is natural for this problem is that any message that P1 attempts to send is eventually correctly received by P2. In view



177

F

C

t ? ? - 6 ? ? D E

S = R; j = i; Y [1::j 1] = X[1::j 1]

h`c1 ; m1 i

'7 : at `0;1 ^ at m0;1 '8 : at `2 ^ at m2;4 ^ :gt h`g1 ; m1 i h`2 ; mg4 i h`2 ; mc4 i `3 '6 : at `3 ^ at m0;1 ^ (:ga _ r = S)

'5: at `2 ^ at m2;3 ^ gt ^ s = R ^ Y [j] = X[j] m3

F

C

S 6= R; j = i + 1; Y [1::j 1] = X[1::j 1]

?

?

h`2 ; mc4 i

'4 : at `3;0;1 ^ at m0;1 ^ :ga '3 : at `2 ^ at m4 h`2 ; mg4 i 6 h`g1 ; m1 i h`c1 ; m1 i m2 ? '2 : at `2 ^ at m2 ^ (:gt _ s 6= R)

? E

'1 : at `3;4 ^ at m0;1 ^ ga ^ r 6= S `4

Fig. 3.19. Possible states of program ALTER.

D


178


of the safety property proved above, it is sucient to show that j eventually increases. This can be expressed by the response property 2: j = u ) (j = u + 1), using rigid variable u to record the current value of j. By invariant I1 , either j = i or j = i + 1. Considering the two cases, it is possible to decompose 2 into the two response properties (i + 1 = j = u + 1) 3: i = j = u ) (i = j = u) 4: i + 1 = j = u ) and prove them separately. Consulting Fig. 3.19, we see that the behavior of the program is partitioned into two alternating phases. The rst phase, occupying the top of the diagram, is characterized by j = i. In this phase process P1 repeatedly attempts to send message X[i] to P2. A successful attempt will lead to '5 , which some steps later terminates the phase. Any failed attempt causes the system to traverse the cycle '7 , '8, and '6 and return to '7 . This cycle cannot repeat inde nitely since each visit to '7 involves a state in which the compassionate transition h`g1 ; m1 i is enabled. By compassion, the system must eventually get to '5 and then proceed to '3 . Response formula 3 states the termination of the upper phase. The second phase, occupying the bottom half of the diagram, is characterized by j = i + 1. In this phase, process P2 attempts to acknowledge correct reception of message X[j] = X[i + 1]. Each failed attempt traverses the cycle '3 , '4 , '2 , returning to '3 once. By compassion, eventually h`2 ; mg4 i must be taken, leading to '1 and the eventual termination of this phase, as required by 1 . To summarize, it cannot be that one of the processes sends in nitely many messages and all of them, from a certain point, arrive corrupted. This implies that, since P1 persistently sends message m[u] until correctly acknowledged, eventually this message will arrive uncorrupted and P2 will increase j to u + 1. Following this correct arrival, process P2 persistently sends an acknowledgement for m[u] (requesting m[i + 1]) until a correct m[u + 1] arrives. Eventually, one of these acknowledgements will arrive correctly and P1 will increase i to u + 1. We proceed to substantiate this intuition by formally proving 2 . As suggested, we rst establish 3: (i = j = u) ) (i + 1 = j = u + 1). The proof of this property, using rule CHAIN-F, is presented in the CHAIN-F diagram of Fig. 3.20. It is easy to verify premises F1{F4 of rule CHAIN-F for assertions '1 and '2 , appearing in Fig. 3.20. It only remains to check eventual enableness of h`g1 ; m1i from '3 -states.

1

11

1



F'

i = j = u; R = S "

at m0;1;4

#

C $

179

& % ? E D '3 :

_

at m2 ^ :gt

g 3.21 h`1 ; m1 i

'2 : at m2 ^ gt ^ s = R m2 '1 : at m3 m3

'0 : i + 1 = j = u + 1

Fig. 3.20. Top-level CHAIN-F diagram for 3 .

1

This means that we have to show at m0;1;4 _ (at m2 ^ :gt ) ) (at `1 ^ at m1 ). This is proven by CHAIN-J as presented in the CHAIN diagram of Fig. 3.21. The proof uses I6 to infer that when P2 is at m2 or at m4 , P1 must be at `2 . It also uses I2 and I3 to infer that, while P2 is at m1 and S = R, P1 can be only at `0 , at `1 , or at `3 with :ga _ r = S. This concludes the proof of the property 3: i = j = u ) (i + 1 = j = u + 1). The second response property ensures that eventually P1 will also increase counter i (i = j = u). 4: i + 1 = j = u ) The proof of this property is presented in the CHAIN-F diagram of Fig. 3.22. Eventual enableness of h`4 ; m5 i is proven by the CHAIN diagram of Fig. 3.23. Combining properties 3 and 4, we obtain the main response property of

1

1


180

F


E F

S = R; j = i at `2

C D

C

'6 : at m2 ^ :gt m2 '5 : at m4

h`2 ; mg4 i; h`2 ; mc4i

F

at m1

'4 : at m0 m0

'3 : at `3 ^ (:ga _ r = S) `3

C

'1 : at `0 `0

E

E

'0 : at `1

D

D

Fig. 3.21. CHAIN diagram for eventual enableness of h`g1 ; m1 i.

program ALTER 2: j = u

)

1

(j = u + 1).



F'

$C & % ? E D

181

i + 1 = j = u; R 6= S "

'3 :

at `0::2

_

#

at `3 ^ :ga

g 3.23 h`2 ; m4 i

'2 : at `3 ^ ga ^ r 6= S `3 '1 : at `4 `4

'0: i = j = u

Fig. 3.22. Top-level CHAIN-F diagram for 4 .

3.5 Well-Founded Rule The next rule we consider is the fair version of rule WELL-J (Fig. 1.26). This version can be obtained by replacing the temporal premise W2 of rule WELL (Fig. 1.23) by the appropriate premises of rule RESP-C for the case that i is compassionate and the appropriate premises of rule RESP-J for a just i . This leads to rule WELL-F (Fig. 3.24). In applications of the rule, it is sucient to establish premise FW2 for all 6= i , since FW2 for = i is implied by FW3. A veri cation diagram corresponding to rule WELL-F is called a RANK-F diagram.

Example (Producer Consumer)

1

Consider program PROD-CONS of Fig. 3.5. Using rule CHAIN-F, we proved accessibility for the producer, i.e., at `2 ) at `4 . However, the main response property of this program is that any value produced by the producer is eventually consumed by the consumer. This property can be written as


182

F


F

S 6= R; j = i + 1

C

C

'5 : at `3 ^ :ga `3 '4 : at `0 `0 '3 : at `1

h`g1 ; m1 i; h`c1 ; m1i

at `2

'2 : at m2 ^ (:gt _ s 6= R) m2

E

E D '0 : at m4

D

Fig. 3.23. CHAIN diagram for eventual enableness of h`2 ; mg4 i. prod (u) )

where we de ne

1

cons (u),

prod (u): at `2 ^ x = u, cons (u): at m6 ^ y = u.

These two state formulas characterize, respectively, the situation that process

Prod has just produced the value u at statement `1 , and the situation that process Cons is about to consume the value u at statement m6 . Substituting the de nitions for prod and cons , we obtain at `2 {z ^ x = u} ) at m6 {z^ y = u} : | | p

1

q



183

For assertions p and q = '0 ; '1; : : :; 'm , transitions 1 ; : : :; m 2 J [ C , a well-founded domain (A; ), and ranking functions 0 ; : : :; m : S 7! A FW1. p !

m _ j =0

'j 2

FW2. ^ 'i !

FW3. i ^ 'i !

m _

6 6 4j =0

('0j

^

_ ('0i ^ i = i0 ) for every 2 T

m _

j =0

('0j ^ i j0 )

1

FW4. If i 2 C , then CW4. 'i ) :'i _ Otherwise JW4. 'i ! En (i ) p )

1

3 9 > > > > > > > 5 > > > > > > > > > > > > > > > =

i j0 )7 7

> > > > > > > > > > > > En (i ) > > > > > > > > > > ;

for i = 1; : : :; m

q

Fig. 3.24. Rule WELL-F (well-founded rule under fairness).

We break the proof into three lemmas.

Lemma A

at `2 ^ x = u )

1

(u 2 b)

This lemma states that if u is produced, it eventually will be placed in buer b. The proof of this lemma closely resembles the proof of accessibility that we have proven before, and therefore will be omitted.

Lemma B

u2b )

1

(at m4 ^ y = u)

This lemma claims that if message u is somewhere in the buer, then eventually it will be read by process Cons and placed in y. The proof of this lemma is presented below.


184


Lemma C

at m4 ^ y = u )

1

(at m6 ^ y = u)

This lemma completes the journey of u, by following Cons from m4 to m6 . It is provable by a simple application of CHAIN-J, and the proof is omitted.

Proof of Lemma B

The proof of Lemma B is assisted by the invariants 0: r 0 ^ ne 0 ^ nf 0 1: r + at `4;5 + at m3;4 = 1 2: ne + nf + at `3::6 + at m2::5 = N. The proof is based on rule WELL-F and is presented in the RANK-F diagram of Fig. 3.25. It uses intermediate assertions '1 ; : : :; '7 . As the well-founded domain we take the lexicographic product N [0::7]. The ranking function for assertion 'i , i = 1; : : :; 7, is given by

F

C

E D

u2b : ind (u; b)

'7 : at m4 m4

'6 : at m5 m5

'5: at m6 m6 '4: at m0 m0

m3 m2 ' : at m m1 ' : at m '1 : at m3 2 2 3 1 Lemma B2 Lemma B1 m3

^

'0 : at m4

y=u

Fig. 3.25. RANK-F diagram for eventual transmission of messages. i :

ind (u; b); i ;



185

where ind (u; b) is de ned as ind (u; b) = min i 1 j b[i] = u : That is, ind (u; b) is the smallest index i, i 1, such that b[i] = u. Clearly, the value of ind (u; b) keeps decreasing as Cons removes elements from b. We rely on the obvious implication u 2 b ! 9i 1: b[i] = u. We adopt the convention by which if u 2= b then ind (u; b) = 0. It follows that ind (u; b) 0 in all cases. It is not dicult to see that premises FW1{FW3 are satis ed by the assertions appearing in the diagram. In particular, we observe that no transition, except for m3 , can change the value of ind (u; b), under the assumption of u 2 b. This also holds for`4 . Also, it is not dicult to see that the full ranking functions i : ind (u; b); i decrease on any helpful transition, unless the goal '0 : at m4 ^ y = u is achieved. The transition m3 , either achieves '0 in the case that ind (u; b) = 1, or maintains u 2 b, with ind (u; b0) < ind (u; b). All other helpful transitions preserve ind (u; b), and lead from the rank ind (u; b); i to the rank ind (u; b); i 1 , for some i, i > 0. Let us consider premise FW4. Most of the helpful transitions are just transitions for which we can easily establish JW4. The exceptions are the compassionate transitions m1 and m2 for which we will establish CW4. To establish CW4, it is sucient to show the eventual enableness of m2 and m3 . These are proven by the two following lemmas.

Lemma B1

at m1 )

1

(at m1 ^ nf > 0)

1

(at m2 ^ r > 0)

The lemma is proven by rule CHAIN-J, as presented in the CHAIN diagram of Fig. 3.26(a). Clearly if nf is not positive it must equal 0. We use invariant 2 and the fact that P2 is at m1 and nf = 0, to deduce that while P1 is at `2 , ne = N > 0. Similarly, we use 1 to deduce that while P1 is at `3 and P2 is at m1 , r is positive.

Lemma B2

at m2 )

The lemma is proven by rule CHAIN-J, as presented in the CHAIN diagram of Fig. 3.26(b). According to 0 and 1 , if r is nonpositive while P2 is at m2 , then r must equal 0, and P1 must reside at `4 or at `5 . This concludes the proof of Lemma B, as well as the proof of the response property that ensures that any value produced by Prod eventually gets consumed by Cons .


186

F

C

at m1 ; nf = 0


at `0

`0

at `1

`1

at `2 ^ ne > 0

`2

at `3 ^ r > 0

`3

at `4

`4

F

at `5

E

`6

^

at m1

nf > 0

(a) Proof of Lemma B1.

C

at `4

`5

at `6

at m2 ; r = 0

`4

DE

at `5

`5

^ at m2

r>0

(b) Proof of Lemma B2.

Fig. 3.26. CHAIN diagrams.

D


3.6 The Dining Philosophers Problem

187

3.6 The Dining Philosophers Problem In Section 2.3 of the SAFETY book, we presented the dining philosophers problem and studied three proposed solutions to the problem given by programs DINE (Fig. 2.15), DINE-CONTR (Fig. 2.16), and DINE-EXCL (Fig. 2.17). In that section, we established the safety property of chopstick exclusion, by which no two adjacent processes (which share a chopstick) can reside in their critical section at the same time. Here, we wish to study the progress property of these solutions, which is the property of accessibility. This property states that every philosopher who becomes hungry (exits its noncritical section) will eventually eat (enter its critical section). As shown in Section 2.3 of the SAFETY book, program DINE may deadlock, which means that no accessibility property is valid for it. It remains to consider the two other programs: DINE-CONTR and DINE-EXCL.

Accessibility for Program DINE-CONTR In Fig. 3.27 we reproduce program DINE-CONTR, rst presented in Fig. 2.16 of the SAFETY book. For this program, we established the following invariant assertions: '0 [j]: c[j] 0; for every j 2 [1::M] '1 [j]: at `4::6 [j] + at `3::5[j + 1] + c[j + 1] = 1; for every j 2 [1::M 2] '2 : at `4::6 [M 1] + at `4::6[M] + c[M] = 1 '3 : at `3::5 [M] + at `3::5 [1] + c[1] = 1:

1

We will show that the accessibility property A[j]: at `2 [j] ) at `4 [j] is valid over program DINE-CONTR for each j 2 [1::M]. The accessibility property A[j] can be decomposed into the two properties: A2;3[j]: at `2 [j] ) at `3 [j] A3;4[j]: at `3 [j] ) at `4 [j]. Obviously, the validity of A2;3[j] and A3;4 [j] implies the validity of A[j], over program DINE-CONTR. We intend to establish properties A2;3 and A3;4 in the following order: First, we will establish A2;3 [j] for every j 2 [2::M 1].

11


188


in M: integer where M 2 local c : array [1::M] of integer where c = 1 3

2

`0 : loop forever do 3 2 7 6 7 6 `1 : noncritical 6 77 6 6 77 6`2 : request c[j] 6 M 1 77 6 6 P[j] :: 66 66`3 : request c[j + 1]77777 j =1 77 6` : critical 6 77 6 4 6 77 6 6 ` : release c[j] 55 4 5 4 `6 : release c[j + 1] 2

3

`0 : loop forever do 37 2 6 6 7 ` : noncritical 1 6 77 6 6 6`2 : request c[1] 77 6 77 6 6 P[M] :: 66 66`3 : request c[M]77777 77 6` : critical 6 77 6 4 6 7 6 6 4`5 : release c[1] 57 4 5 `6 : release c[M] Fig. 3.27. Program DINE-CONTR: solution with one contrary philosopher.

Then, we establish by induction on decreasing j the properties A3;4 [j] for j = M; M 1; : : :; 1. Finally, we establish A2;3[1] and A2;3 [M].

Proving A2;3[j] for j 2 [2::M 1] Let j 2 [2::M 1]. The property A2;3[j]: at `2 [j] ) at `3 [j]

1

-

is proven by the following CHAIN-F diagram at `2 [j]

`2 [j] E2[j]

at `3 [j]

The proof relies on the compassionate transition `2 [j]. As required for valid



189

diagrams involving compassionate transitions, we have to establish the eventual enableness of `2 [j] stated by the formula E2[j]: at `2 [j] ) at `2 [j] {z^ c[j] > 0} : |

1

En (`2 [j ])

Property E2[j] is proven by the CHAIN diagram of Fig. 3.28.

F E

at `2 [j]; c[j] = 0 at `4 [j 1]

`4 [j 1]

at `5 [j 1]

`5 [j 1]

C

D

^ at `6 [j 1]

`6 [j 1]

at `2 [j]

c[j] > 0

Fig. 3.28. CHAIN diagram for E2 [j].

This proof relies on assertion '0 [j]: c[j] 0 to infer that : c[j] > 0 implies c[j] = 0. Then, we use assertion '1[j 1]: at `4::6[j 1] + at `3::5[j] + c[j] = 1 to infer that at `2 [j] ^ c[j] = 0 implies at `4::6 [j 1].

Proving A3;4[j] for j = M; M 1; : : :; 1

1

Next, we establish the property A3;4[j]: at `3 [j] ) at `4 [j] by induction on decreasing j = M; M 1; : : :; 1.

Induction Basis

1

For the induction basis, we prove A3;4[j]: at `3 [j] ) at `4 [j] for j 2 fM 1; M g. We can establish A3;4 for both M 1 and M in one proof because both processes compete on c[M] at location `3 and release c[M] at location `6 . Let j denote one of the indices in fM 1; M g, and k denote the other index. Thus, if j = M 1 then k = M and if j = M then k = M 1.


190


-

Property A3;4[j] is proven by the following CHAIN-F diagram: at `3 [j]

1

`3 [j] E3[j]

at `4 [j]

The diagram requires establishing the eventual enableness of `3 [j] given by E3[j]: at `3 [j] ) at `3 [j] ^ c[M] > 0 : This is established by the CHAIN diagram of Fig. 3.29.

F E

at `2 [j]; c[M] = 0 at `4 [k]

`4 [k]

at `5 [k]

C D ^

`5 [k]

at `6 [k]

`6 [k]

at `3 [k]

c[M] > 0

Fig. 3.29. CHAIN diagram for E3 [j].

The proof uses '0 [M]: c[M] 0 to infer c[M] = 0 from : c[M] > 0 and the invariant '2: at `4::6[M 1] + at `4::6[M] + c[M] = 1 to infer at `4::6[M 1] from at `3 [M] ^ c[M] = 0, and to infer at `4::6 [M] from at `3 [M 1] ^ c[M] = 0.

Induction Step

We show that A3;4[j + 1] implies A3;4 [j] for each j 2 [1::M 2]. Assume that A3;4[j + 1] has been established. Property A3;4[j]: at `3 [j] ) at `4 [j] is proven by the following CHAIN-F diagram: ` [j] - at ` [j] at `3 [j] 3 4 E3[j]

1

1

The required eventual enableness condition E3[j]: at `3 [j] ) at `3 [j] ^ c[j + 1] > 0



F E

at `3 [j]; c[j+1] = 0 at `3 [j+1]

191

C

D

^

A3;4[j+1] at ` [j+1] `4 [j+1] 4

at `5 [j+1]

`5 [j+1]

at `3 [j]

c[j+1] > 0

Fig. 3.30. CHAIN diagram for E3[j] (for the inductive step).

is proven by the CHAIN diagram of Fig. 3.30. The proof uses assertion '0 [j + 1]: c[j + 1] 0 to infer c[j + 1] = 0 from : c[j + 1] > 0 and assertion '1[j]: at `4::6 [j] + at `3::5[j + 1] + c[j + 1] = 1 to infer at `3::5[j + 1] from at `3 [j] ^ c[j + 1] = 0. It uses the assumption A3;4[j + 1] to ensure that if P[j + 1] is at `3 it will eventually arrive to `4 . In the diagram, this is represented by the dashed edge labeled by A2;3 [j]. This concludes the proof of A3;4[j] for all j 2 [1::M].

Proving A2;3[j] for j 2 f1; M g

1

Finally, we prove A2;3[j]: at `2 [j] ) at `3 [j] for j 2 f1; M g. Again, it is possible to present a single proof for these two indices since both P[1] and P[M] compete for c[1] at location `2 and release c[1] at location `5 . As before, let j denote one of the two indices in f1; M g and k denote the other index. The proof of A2;3[j] is established by the following diagram:

-

` [j] at `2 [j] 2 E2[j]

by

at `3 [j]

The proof is completed by establishing the eventual enableness of `2 [j], given


192


E2[j]: at `2 [j] )

1

at `2 [j] {z ^ c[1] > 0} : En (`2 [j ])

|

This property is proved by the CHAIN diagram of Fig. 3.31.

F E

at `2 [j]; c[1] = 0 at `3 [k]

A3;4[k]

at `4 [k]

C D

^ `4 [k]

at `5 [k]

`5 [k]

at `2 [j]

c[1] > 0

Fig. 3.31. CHAIN diagram for E2[j] for j 2 f1; M g.

The proof uses assertion '0 [1]: c[1] 0 to infer c[1] = 0 from : c[1] > 0 . It uses assertion '3: at `3::5[M] + at `3::5[1] + c[1] = 1 to infer at `3::5[M] from at `2 [1] ^ c[1] = 0, and to infer at `3::5 [1] from at `2 [M] ^ c[1] = 0. This concludes the proof of accessibility for all processes of program DINE-CONTR.

Accessibility for Program DINE-EXCL In Fig. 3.32 we reproduce program DINE-EXCL, rst presented in Fig. 2.17 of the SAFETY book. In contrast to program DINE-CONTR in which process P[M] has a dierent program than all other processes, processes in program DINE-EXCL have identical programs. Symmetry is broken in program DINE-EXCL by the semaphore r which admits at most M 1 processes to the location range `3::8. In Section 2.3 of the SAFETY book, we established for program DINE-EXCL the following invariants '0 [j]: c[j] 0 for all j 2 [1::M] '1 [j]: at `5::7[j] + at `4::6 [j M 1] + c[j M 1] = 1 for all j 2 [1::M] '2 : r 0 '3 : N3::8 + r = M 1:



193

in M: integer where M 2 local c : array [1::M] integer where c = 1 r : integer where r = M 1 3

2

`0 : loop forever do 37 2 6 `1 : noncritical 7 6 6 77 6` : request r 6 77 6 2 6 77 6 6 77 6`3 : request c[j] 6 M 77 6 6 P[j] :: 66 66`4 : request c[j M 1]77777 j =1 77 6` : critical 6 77 6 5 6 77 6 6 ` : release c[j] 77 6 6 7 6 6 6 4 `7 : release c[j M 1] 575 4 `8 : release r Fig. 3.32. Program DINE-EXCL: one philosopher stays out.

1

Here we estabish the accessibility property A[j]: at `2 [j] ) at `5 [j]. As before, we break the accessibility property into three steps A2;3[j]: at `2 [j] ) at `3 [j] A3;4[j]: at `3 [j] ) at `4 [j] A4;5[j]: at `4 [j] ) at `5 [j]. We establish A3;4[j] rst, followed by A4;5 [j], followed by A2;3[j].

Proving A3;4[j]

11 1

1

The response property A3;4[j]: at `3 [j] ) at `4 [j] is proven by the following CHAIN-F diagram: ` [j] - at ` [j] at `3 [j] 3 4 E3[j]

1

Eventual enableness of compassionate transition `3 [j] is stated by E3[j]: at `3 [j] ) at `3 [j] {z^ c[j] > 0} | En (`3 [j ])


194

F


C D E

^

at `3 [j]; c[j] = 0

at `5 [j M 1] at `5 [j M 1] at `6 [j M 1]

`6 [j M 1]

at `7 [j M 1]

`7 [j M 1]

at `3 [j]

c[j] > 0

Fig. 3.33. CHAIN diagram of E3[j] (for program DINE-EXCL).

and is proven in the CHAIN diagram of Fig. 3.33. The proof uses '0 [j]: c[j] 0 to infer c[j] = 0 from : c[j] > 0 and assertion '1[j M 1]: at `5::7 [j M 1] + at `4::6[j] + c[j] = 1 to infer at `5::7[j M 1] from at `3 [j] ^ c[j] = 0.

Proving A4;5[j]

Since processes in program DINE-EXCL are fully symmetric it is sucient to prove A4;5 for a particular value of j, say j = 1 A4;5[1]: at `4 [1] ) at `5 [1]. The proof of A4;5[1] is presented in the following CHAIN-F diagram:

1

-

` [1] at `4 [1] 4 E4[1]

1

at `5 [1]

The required eventual enableness of `4 [1] is stated by E4[1]: at `4 [1] ) at `4 [1] {z^ c[2] > 0} | En (`4 [1])



F E

at `4 [1]; c[2] = 0 at `4 [2]

`4 [2] E4 [2; 1]

at `5 [2]

195

C

D

^ `5 [2]

at `6 [2]

`6 [2]

at `4 [1]

c[2] > 0

Fig. 3.34. CHAIN-F diagram of E4[1].

and can be proven by the CHAIN-F diagram of Fig. 3.34. In this proof we use '0 [2] and '1 [1] to infer that at `4 [1] ^ : c[2] > 0 implies at `4::6 [2]. The eventual enableness proof obligation for `4 [2] is given by E4[2; 1]: at `4 [1] ^ at `4 [2] ) at `4 [2] {z^ c[3] > 0} : |

1

En (`4 [2])

We denote it by E4[2; 1] because it claims the eventual enableness of `4 [2] while P[1] is also at `4 . Obviously, a proof of E4[2; 1] will analyze the locations of process P[3] and rely on an eventual enableness requirement given by E4[3; 1; 2]: at `4 [1] ^ at `4 [2] ^ at `4 [3] ) at `4 [3] {z^ c[4] > 0} : |

1

En (`4 [3])

Assume we constructed this sequence of veri cation diagrams reaching process P[M 2]. For this process, we need to establish E4[M 2; 1; 2; : : :; M 3]: at `4 [1] ^ ^ at `4 [M 2] ) at `4 [M 2] {z^ c[M 1] > 0} : |

1

En (`4 [M 2])

This property can be established by the CHAIN-F diagram of Fig. 3.35. The eventual enableness requirement is given by E4[M 1; 1; : : :; M 2]: at `4 [1] ^ ^ at `4 [M 1] ) at `4 [M 1]{z^ c[M] > 0} : |

1

En (`4 [M 1])


196


F

C

?

at `4 [1] ^ ^ at `4 [M 2]

c[M 1] = 0

at `4 [M 1]

E4[M 1; 1; : : :; M 2] `4 [M 1] at `5 [M 1]

`5 [M 1]

E

at `6 [M 1]

D

`6 [M 1]

at `4 [M 2]

^

c[M 1] > 0

Fig. 3.35. CHAIN-F diagram of E4[M 2; 1; 2; : ::; M 3].

However, in view of '2 and '3 , N3::8 M 1, which means that at `4 [1] ^ ^ at `4 [M 1] implies at `0::2 [M]. Considering '1 [M 1], we see that at `4 [M 1]^ at `0::2 [M] implies c[M] = 1. We conclude that the implication at `4 [1] ^ ^ at `4 [M 1] ! at `4 [M 1] ^ c[M] > 0 is P-state valid, implying the validity of E4[M 1; 1; : : :; M 2].

Proving A2;3[j]

1

Finally, we prove the response property A2;3[j]: at `2 [j] ) at `3 [j]. This property can be proven by the CHAIN-F diagram:

-

`2 [j] E2[j]

at `2 [j]

1

at `3 [j]

It remains to discharge the proof obligation E2[j]: at `2 [j] ) at `2 [j] ^ r > 0 :


3.7 Allocation of Quanti able Resources

197

Obviously, it suces to prove the entailment starting from a state which satis es :(r > 0) at `2 [j] ^ r = 0 ) at `2 [j] ^ r > 0 : By '2 and '3, it follows that at `2 [j] ^ r = 0 ! 9k 2 [1::M]: at `2 [j] ^ at `3::8[k], stating that if r is not positive, some process P[k] must be executing at some location in the range [`3 ::`8]. Therefore, it is sucient to prove the property at `2 [j] ^ at `3::8[k] ) at `2 [j] ^ r > 0 : This proof is presented in the CHAIN diagram of Fig. 3.36.

1

1

F

E

at `2 [j]; r = 0

at `3 [k]

A3;4[k]

at `4 [k]

`7

at `8 [k]

`8

D A4;5 [k]

at `5 [k]

`5

at `7 [k]

f

^ at `2 [j]

C

`6

at `6 [k]

`8 [i] j i 2= fj; kg

r>0

Fig. 3.36. CHAIN diagram for E2 [j]. This concludes the proof of accessibility for program DINE-EXCL.

3.7 Allocation of Quanti able Resources One of the problems that requires coordination between concurrent processes is the management of limited resources. There are dierent types of resources in a system. Some resources, such as the ownership of a particular printer or a shared variable, form one indivisible unit that must be granted in its entirety to a single process at a time. Others, such as disk or memory space, consist of a large number


198


of identical units, which may be granted to several processes at the same time, provided the sum of granted quantities never exceeds a given available total. Typically, before entering a particular activity, to which we refer as \a critical section," a process requests a certain quantity of units, and must wait for this quantity to be granted before entering the critical section. Most of our previous examples considered resources of the atomic type. We now focus our attention on the allocation of resources of the second, quanti able , type. To set a general framework, we consider M > 0 processes P1 ; : : :; PM , and a single resource having N > 0 units. Assume that an array X[1::M] represents the needs the processes in units of the resource. That is, process Pi needs X[i] units of the resource in order to perform correctly its critical activity. Naturally, we have to assume that X[i] N for every i = 1; : : :; M, but this is the only assumption we make. This assumption states that there are suciently many units of the resource to satisfy the needs of each process separately. In the following, we use our notation for parameterized programs, by which La denotes the set of indices of processes that currently execute at à and La::b denotes the set of indices of processes currently executing at any of à ; à+1; : : :; `b . Similarly, Na = jLa j and Na::b = jLa::bj.

A First Approximation

A rst approximation to an algorithm that manages the allocation of a quanti able resource is presented in parameterized program INADEQUATE of Fig. 3.37. In the critical section of P[i], X[i] units of the resource are used. The program uses the generalized semaphore statements request (r; C), whose eect is equivalent to hawait r C; r := r C i, and release (r; C), whose eect is equivalent to r := r + C. The request (r; C) statement is associated with a compassion requirement, prescribing that it is impossible for the statement to be enabled in nitely many times, but executed only nitely many times.

Safety



199

in M; N: integer where M > 0; N > 0 X : array [1::M] of integer where 8i 2 [1::M]: X[i] N local r : integer where r = N 2

3

`0 : loop forever do 2 6 `1 : noncritical 3777 6 M 6 P[i] :: 66 666`2 : request r; X[i] 77777 6 i=1 57 4`3 : critical 4 5 `4 : release r; X[i] Fig. 3.37. Program INADEQUATE (inadequate allocation of quanti able resource).

It is easy to see that the program of Fig. 3.37 has the right safety property of exclusion. Exclusion in this case means that the sum of allocated units of the resource never exceeds N. This can be expressed by X

i2L3

X[i] N.

This formula takes the sum of all X[i] for processes P[i] that are currently at `3 , and requires that the sum never exceeds N. This safety property can be deduced from the two invariants 0 : r 0 1 :

X

i2L3;4

X[i] + r = N.

It is clear that execution of `2 [i] increments the sum by X[i] and decrements r by the same amount. Similarly, transition `4 [i] leaving the range `3;4, decrements the sum and increments r by X[i].

Individual accessibility not guaranteed

The program of Fig. 3.37 does not ensure accessibility for each process wishing to enter `3 , that is, it does not satisfy at `2 [i] ) at `3 [i] for every i; 1 i M. To show this, consider the particular case of three processes (M = 3), with N = 2 and the array of resource requirements given by X[1] = X[2] = 1, X[3] = 2. Consider the computation

1


200 D


E

: `0 [1]; `0 [2]; `0 [3] ; r: 2 D

P [1];P [2];P [3]

!

E

: `2 [1]; `2 [2]; `2 [3] ; r: 2

P [1];P [2]

!

D

E [1] : `3 [1]; `3 [2]; `2 [3] ; r: 0 P ! D E [1] : `2 [1]; `3 [2]; `2 [3] ; r: 1 P ! E D E [2] [2] : `3 [1]; `3 [2]; `2 [3] ; r: 0 P ! : `3 [1]; `2 [2]; `2 [3] ; r: 1 P !

D

D

E

: `3 [1]; `3 [2]; `2 [3] ; r: 0 : This computation consists of a nite pre x reaching the state D E : `3 [1]; `3 [2]; `2 [3] ; r: 0 ;

followed by an in nite repetition of a segment. The segment starts with both P[1] and P[2] at `3 . Then P[1] performs a complete cycle and ends back at `3 , followed by a similar cycle performed by P[2]. Throughout the segment, P[3] waits at `2 . The computation is compassionate with respect to P[3], even though P[3] continuously waits at `2 . This is because transition `2 [3] is never enabled in the in nitely repeating segment, having r 1 at all states of this segment. This computation illustrates the possibility of P[1] and P[2] conspiring against P[3], leaving it stranded at `2 . In Problem 3.3 the reader is requested to prove the weaker property of communal accessibility N2 > 0 ) (N3 > 0) for program INADEQUATE.

An Improved Solution

1

To remedy the fault of the previous solution, we must be able to assign priorities to the dierent processes. If the assignment of priorities is fair and the process with highest priority is guaranteed to enter its critical section, then individual accessibility will be ensured. We can look at the possession of the highest priority as another resource, atomic this time, and implement its allocation by another semaphore. This leads to program Q-RES of Fig. 3.38. This program uses semaphore variable p to grant high priority to precisely one process. The process that gains this priority is allowed to make a request of the quanti able resource r, and waits until this request is granted. While this process is waiting, no other process can make a request to r. Consequently, the only possible changes to r while this process is waiting at `3 are caused by processes that exit their critical section and increment r by X[i]. Eventually r must become greater or equal to the quantity



201

in M; N: integer where M > 0; N > 0 X : array [1::M] of integer where 8i 2 [1::M]: X[i] N local r; p : integer where r = N; p = 1 2

3

`0 : loop forever do 37 2 6 7 6 `1 : noncritical 6 77 6 6 77 6`2 : request p 6 M 77 6 6 P[i] :: 66 66`3 : request r; X[i] 77777 i=1 77 6`4 : release p 6 77 6 6 77 6 6 ` : critical 5 4 4 55 `6 : release r; X[i] Fig. 3.38. Program Q-RES (allocation of quanti able resource).

requested by the waiting process. At that stage, the waiting process is granted its request and relinquishes its high priority at `4 on the way to the critical section. Let us verify the correctness of program Q-RES.

Safety

Exclusion requires the invariant

X

i2L5

X[i] N.

This can be established by the invariants 0 : r 0 ^ p 0 1: N3;4 + p = 1 2 :

X

i2L4::6

X[i] + r = N.

In particular, exclusion is deducible from 2 and r 0.

Individual accessibility

1

To show accessibility, we prove at `2 [i] ) at `5 [i]. The CHAIN-F diagram of Fig. 3.39 presents the proof of this property by rule CHAIN-F.


202

- -


at `2 [i]

`2 [i] Lemma 1

`3 [i] Lemma 2

at `3 [i]

at `4 [i]

`4 [i]

at `5 [i]

Fig. 3.39. CHAIN-F diagram for accessibility.

The more interesting part of this diagram is the proof of eventual enableness of transitions `2 [i] and `3 [i]. This is proved by Lemmas 1 and 2.

Lemma 1

at `2 [i] )

1

at `2 [i] ^ p > 0

The nontrivial case is when p = 0 while P[i] is at `2 [i]. Due to 1, this is possible only if at `3;4[j] for some j 2 [1::M]. Therefore, we prove at `2 [i] ^ at `3;4[j] ) at `2 [i] ^ p > 0 : This is proven by the CHAIN-F diagram of Fig. 3.40.

1

F E

at `2 [i]

at `3 [j]

`3 [j] Lemma 2

at `4 [j]

`4 [j]

C

D p>0

Fig. 3.40. CHAIN-F for Lemma 1. Note that this proof also relies on Lemma 2 to provide the eventual enableness of `3 [j].

Lemma 2

at `3 [i] )

1

at `3 [i] ^ r X[i]

The proof of this lemma requires the use of the well-founded rule. The case we have to deal with is at `3 [i] ^ r < X[i]. Since X[i] N, it follows that r < N. According to 2, this can hold only if N4::6 > 0. Since at `3 [i] and 1 imply N4 = 0, it follows that N5;6 > 0.



F

k 2 [1::M]: at `3 [i]; r < X[i]; N4 = 0 : L5;6

203

C

E D '2 : at `5 [k] `5 [k] '1 : at `6 [k] `6 [k] `6 [k]

^ '0 : at `3 [i]

r X[i]

Fig. 3.41. CHAIN diagram for Lemma 2.

The lemma is proved by rule WELL-JP (Fig. 2.2), as shown in the CHAIN diagram of Fig. 3.41. The double edge connecting '2 : at `5 [k] to '1: at `6 [k] represents a transition of process P[k] from `5 to `6 . The two edges departing from '1 : at `6 [k] represent a movement of process P[k] from `6 back to `0 . Such movement decreases L5;6 and increases r. If, as a result of the increase, r becomes greater or equal to X[i], we have reached the goal '0 . This possibility is represented by the edge connecting '1 to '0 . In the other case, r is smaller than X[i] even after the increase, and by the previous argument r < X[i] and at `3 [i] imply L5;6 6= ;, which means that, for some other k 2 [1::M], either at `5 [k] or at `6 [k] holds. This is represented by the edge connecting '1 to the compound node containing both '2 and '1. Note that as long as r < X[i], P[i] cannot move from `3 to `4 , and therefore N4 remains zero and N5;6 cannot increase. This concludes the proof of accessibility. We remind the reader that most of the solutions to the readers-writers problem (Fig. 2.26) can be viewed as a special case of the quanti able resource allocation. In these solutions, M = N and X[i] = 1 for a reader, and X[i] = M for a writer. Consequently, the program in Fig. 3.38 also provides a solution to the readerswriters problem that ensures individual accessibility.

Response with Past Subformulas

1

Up to this point, we have only considered response formulas p ) q, in which p and q are assertions. The generalization to the case that p or q are past formulas is straightforward. As indicated in Section 1.6, this generalization replaces intermediate assertions by intermediate past-formulas, and implications by entailments.


204


In Fig. 3.42, we present the general version of rule WELL-F. The other F-rules can be generalized in a similar way. For past formulas p and q = '0 ; '1; : : :; 'm , transitions 1 ; : : :; m 2 J [ C , a well-founded domain (A; ), and ranking functions 0 ; : : :; m : S 7! A m _

FW1. p )

j =0

'j 2

FW2. ^ 'i )

FW3. i ^ 'i !

m _

6 6 4j =1

('0j

^

_ ('0i ^ i = i0 ) for every 2 T

m _

j =0

('0j ^ i j0 )

1

FW4. If i 2 C , then CW4. 'i ) :'i _ Otherwise JW4. 'i ) En (i ) p )

1

3 9 > > > > > > > 5 > > > > > > > > > > > > > > > =

i j0 )7 7

> > > > > > > > > > > > En (i ) > > > > > > > > > > ;

for i = 1; : : :; m

q

Fig. 3.42. General version of rule WELL-F.

** 3.8 Completeness:

State Response

In this and the following section we will show that rule WELL-F (Fig. 3.42) is complete for proving P-validity of a given response formula p ) q. We follow a strategy similar to the one taken in Chapters 1 and 4 of the SAFETY

1


3.8 Completeness: State Response

205

book and divide the proof into two steps. In the rst step, covered in this section, we show WELL-F to be complete for state response formulas, i.e., the case that p and q are assertions. In a second step, covered in the next section, we use the stati cation techniques introduced in Chapter 4 of the SAFETY book to show that completeness for the assertional case implies completeness for the general case in which p and q are past formulas. The precise statement of completeness for state response formulas is given by the following theorem.

Theorem 3.2 (completeness of rule WELL-F, state response)

1

For every two assertions p and q such that p ) q is P-valid, there exist assertions q = '0 , '1; : : :; 'm , transitions 1 ; : : :; m 2 J [ C , a well-founded domain fA; g, and ranking functions 0 ; : : :; m : S 7! A, such that the premises of rule WELL-F (Fig. 3.24) are provable from state validities. We prove the theorem in this section.

Preliminaries Let P be a fair transition system with justice set J and compassion set C . We refer to the union of J and C as the fairness set of P and denote it by F = J [C . Assume that F = f1 ; : : :; m g. For the case that p and q are assertions, we will show that for every p and q there exist intermediate assertions 'i , one for each fair transition i 2 F , i = 1; : : :; m, a well-founded domain (A; ), and ranking functions 1 ; : : :; m such that premises FW1{FW3 and subpremise JW4 are satis ed as P-state valid implications, and subpremise CW4 is P-valid. From the corollary to the completeness theorem of state invariances (Section 2.5 of the SAFETY book) it follows that premises FW1{FW3 and subpremise JW4 are provable from state validities. Subpremise CW4 will be shown to be provable from state validities in the course of the completeness proof. An interesting conclusion of the completeness proof is that, while a rst-order language over the integers and additional data domains is adequate for expressing all the constructs required by the safety rules, it is no longer adequate for expressing the necessary response constructs. Several extensions to the assertion


206


language have been suggested. We will use the extension that allows notions such as ordinals and xpoints to write formulas that quantify over predicates. In the construction of ranking functions, we intend to construct a single ranking function : S 7! A, and take 1 = = m = .

The Kernel of the Intermediate Assertions The intermediate assertions '1 ; : : :; 'm we intend to construct have the common form 'i : ' ^ i ; for i = 1; : : :; m. Assertion ' is a common conjunct appearing in all 'i 's, to which we refer as the kernel of '1 ; : : :; 'm . Here, we de ne the common assertion ' and argue that it can be expressed in a rst-order assertion language. We de ne a (P-)segment to be a nite sequence of states [sa ; : : :; sb ] such that a b and for every i, a i < b, si+1 is a -successor of si for some transition of P. A segment [sa ; : : :; sb ] is called (P-)accessible if state sa is P-accessible. Obviously, if [sa ; : : :; sb ] is accessible then there exists a P-computation containing [sa ; : : :; sb ] as a segment. A segment [sa ; : : :; sb ] is called q-free if no si , a i b, satis es q. We say that [sa ; : : :; sb ] is a (p; q)-segment if it is an accessible q-free segment such that sa p. Based on this notion, we de ne an assertion Q such that s Q $ there exists a (p; q)-segment [sa ; : : :; sb ] where sb = s. Thus, Q characterizes all states that can appear as last states in a (p; q)-segment. The de nition implies that s satis es Q if and only if there exists a pre x [s0 ; : : :; sb ] of a P-computation, such that sb = s and there exists a position a, 0 a b, such that p holds at a and no position i, a i b, satis es q. Our interest in Q is motivated by the following claim.

qq

1

Claim 3.3 (characterizes q-pending states) Assume that p ) q is P-valid and that is a P-computation such that Q holds at position i 0. Then q holds at some position k i (in fact k > i). Or equivalently: if p ) q is P-valid then so is the response formula Q ) q.

1

1

Thus, Q characterizes all states that must have a following q in all computations.

Justi cation To justify the claim, let s = si be the state appearing at position i of . Consider the in nite sequence si+1 ; si+2 ; : : : obtained by removing the



q

207

q

pre x s0 ; : : :; si from . By de nition of Q, there exists a pre x sb0 ; : : :; bsb such that sbb = s, sba p for some a, 0 a b, and bsj = q for all j, a j b. Consider the spliced sequence e: bs0 ; : : :; bsb ; si+1 ; si+2 ; : : : . Since bsb = s = si , this sequence is obviously a computation and p holds at position a of e. Since p ) q is P-valid there exists some position r a such that q holds at position r of e. Since q cannot hold at any j, a j b, it follows that r > b. It follows that q holds at position k of the original computation , where k = r b + i > i.

1

Using the techniques of Section 2.5 of the SAFETY book, we can write a rstorder formula '(V ) using dynamic arrays which expresses Q. We take ' = Q to be the common part of the intermediate assertions.

Example Consider program UP-DOWN of Fig. 3.43 (see also Fig. 1.27). The response property y = 10 ) y| {z = 5} | {z }

1

p

is valid over this program.

q

local x; y: integer where x = y = 0 `0 : while x = 0 do3 6 `1 : y := y + 1 77 6 6 P1 :: 66`2 : while y > 0 do777 4 `3 : y := y 1 5 `4 : 2

P2 ::

m0 : x := 1 m1 :

Fig. 3.43. Program UP-DOWN. The kernel assertion Q, relative to p: y = 10 and q: y = 5, can be given by Q: acc P ^ y > 5, where acc P : (at m0 ^ at `0;1 ^ x = 0 _ at m1 ^ at `0::4 ^ x = 1) ^ y at `3 ^ (at `4 ! y = 0)


208


characterizes all the accessible states for this program. Note that if we observe a state s in which y = 6 in a computation , it does not necessarily imply that a pre x containing a (y = 10)-position is part of that computation. The value 6 may well be the highest value attained by y in . We are only guaranteed that there exists some pre x (possibly not present in ) containing a (y = 10)-position and ending in our (y = 6)-state without encountering a (y = 5)-position in between. However, the preceding claim guarantees that every (y = 6)-position is followed by a (y = 5)-position.

q

We denote by kQk the set of all states satisfying Q. A segment : [sa ; : : :; sb ] is called a Q-segment if si Q for every i 2 [a::b].

A Primary Order The identi cation of the ranking functions, mapping states into a well-founded domain, is based on the identi cation of a well-founded ordering over the states of the program. For a segment : [sa ; : : :; sb ], we say that leads from sa to sb . Transition i 2 F is said to be grati ed in a segment : [sa ; : : :; sb ] if i is taken in , or i 2 J C and i is disabled on some sj , j 2 [a::b]. We denote by grat () the index set of the transitions that are grati ed in grat (): fi j i 2 F is grati ed in g. A segment is called fair if it grati es all fair transitions, i.e., grat () = [1::m]. Note that a compassionate transition 2 C is considered to be grati ed in if it is taken in . In this, the compassionate transitions dier from just transitions which can be grati ed also by being disabled somewhere in .

Example Consider program UP-DOWN of Fig. 3.43. The set of fair transitions for

this program consists of the just transitions `0 , `1 , `2 , `3 , and m0 . The segment

1: : f`0; m0 g; x: 0; y: 5 ; : f`1 ; m0g; x: 0; y: 5 is not fair. Segment 1 grati es transitions `0 , `1 , `2 , and `3 but does not gratify m0 . Note that `0 {`3 are grati ed since each has a state within 1 on which the transition is disabled. On the other hand, the following extension of 1 ,

2: : f`0; m0 g; x: 0; y: 5 ; : f`1 ; m0g; x: 0; y: 5 ; : f`1; m1 g; x: 1; y: 5 is fair since it grati es all fair transitions.



209

We de ne a binary relation A between states in kQk as follows: s1 A s2 i there exists a fair Q-segment leading from s1 to s2 .

Claim 3.4 (well-foundedness of A) The relation A is a well-founded order over kQk. Justi cation We start by showing that A is a well-founded relation over kQk.

Assume to the contrary, that there exists an in nite sequence of states s1 ; s2; : : : 2 kQk, such that s1 A s2 A . By the de nition of Q and the meaning of A, there exists an in nite sequence of states as follows q-free and fair }| { : s0 ; : : :; |sa ; :{z: :; s1} ; : : :; s|2 ; :{z: :; s3} ; : : : q-free q-free and fair z

q

where sa p. This sequence satis es the fairness requirement since in each segment [si ; : : :; si+1 ] each transition i 2 C is either taken at least once or is disabled on all states in the segment, and each transition i 2 J C is either taken or disabled on some state in the segment. On the other hand, p holds at position a of and q does not hold at any position j a, in violation of our assumption that p ) q is P-valid. Next, we show that A is an ordering relation over kQk. Relation A is antisymmetric. This is because the existence of s1 , s2 such that s1 A s2 and s2 A s1 gives rise to the in nitely descending sequence s1 A s2 A s1 A s1 A , which violates the just-proven well-foundedness of A. Irre exivity is proven in the same way by taking s1 = s2 . Transitivity follows from the de nition of A. Namely, if there exists a fair Q-segment sa ; : : :; sb and a fair Q-segment sb ; : : :; sc , then the Q-segment sa ; : : :; sb ; : : :; sc obtained by dove-tailing these two segments is fair and establishes sa A sc .

1

Example Consider program SKIP2 presented in Fig. 3.44.

The set of fair (just) transitions for this program is: F : f1 : `1 ; 2 : È2 ; 3 : `3 ; 4 : `4 ; 5 : `X2 g, where È2 and `X2 are the entry and exit transitions from the cooperation statement `2 . The response property we investigate for program SKIP2 is


210


2

3

`1 : skip h 6 6`2 : [`3: skip; `5 : ] 4 `7 :

[`4 : skip; `6 : ]

i7 7 5

Fig. 3.44. Program SKIP2.

at `3 {z ^ at `4} )

|

p

1

at `7 : | {z } q

The corresponding assertion Q should characterize all the states which can be reached from accessible states satisfying p: at `3 ^ at `4 without passing through a state satisfying q: at `7 . Therefore, Q is given by Q: at `3;5 ^ at `4;6.

? ? ? s3;4 : h: f`3; `4 gi

A

s5;4 : h: f`5 ; `4gi

A

s3;6 : h: f`3 ; `6gi

A

s5;6 : h: f`5; `6 gi

Fig. 3.45. Q-states of program SKIP2 related by A.

In Fig. 3.45, we present the four Q-states of this program and their ordering by relation A. For example, segment [s5;4; s5;6] is fair, i.e., grati es all fair transitions 1 {5: it grati es 1 , 2 , 3 , and 5 (i.e., `1 , È2 , `3 , and `X2 ) because they are all disabled on s5;4; it grati es 4 : `4 by taking this transition in the step from s5;4 to s5;6 . On the other hand, the segment [s3;4; s5;4] is not fair since it does not gratify `4 , which is enabled on all states in the segment but not taken there. This is why there is no A-labeled edge connecting s3;4 to s5;4 in Fig. 3.45, nor is there a A-labeled edge from s3;4 to s3;6.



211

The Primary Order is Too Coarse Order A is a good rst approximation to the order we need. It is well-founded and measures progress in the sense that when the system moves from state s1 to state s2 such that s1 A s2 , a progress step has been taken. This is because the system cannot take in nitely many such steps. Unfortunately, the order A only provides a coarse measure of progress. Reconsider program SKIP2 presented in Fig. 3.44 and the A-ordering of its Q-states in Fig. 3.45. Clearly, every step leading from one Q-state to another represents progress towards the goal q: at `7 . However, the order A identi es only segments leading to s5;6 as observable progress. In particular, it does not identify the moves from s3;4 to either s5;4 or s3;6 as observable progress. It is possible to conclude that A successfully measures coarse progress but is insensitive to ner progress. As a rst step in the re nement of A, we nd a ranking function into a well-founded domain, whose ordering is compatible with A.

Mapping into the Ordinals As a rst approximation of the well-founded domain (A; ), we take (O; >), where O is the domain of the ordinals and > is the natural order over the ordinals.

We remind the reader that the ordinals are obtained by extending the sequence of natural numbers beyond the nite naturals. There are very few facts about the ordinals that are required in our proof here. Following is a list of some of these properties: Every natural number is an ordinal. We refer to the naturals as the nite ordinals . There is a total order < on the ordinals which generalizes the \smaller than" ordering over the naturals. Some ordinals are the immediate successors of another ordinal , and we write = + 1. Others are limit ordinals and are de ned as the smallest ordinal greater than (least upper bound of) all ordinals in a given set. For example, ! is the limit ordinal obtained as the least upper bound of all nite ordinals, and is usually described as the rst in nite ordinal. The ordinal ! + 1 is a non-limit ordinal and is the immediate successor of !. The order > (\greater than") is well-founded over the ordinals. There exists an induction principle over the ordinals, called trans nite induction , which generalizes the complete induction principle over the naturals. It can be stated as


212


8 8 < : '( ) ! '() ! 8 : '( ).

This principle claims that if we can prove the induction step then the property ' holds for every ordinal. The induction step requires showing, for every , that if '( ) for all < then ' holds for ordinal . Ordinals are not so mysterious as they may sometimes appear to be. In fact, we have already introduced and extensively used structures that are isomorphic to the low in nite ordinals. A lexicographic pair of natural numbers (m; n) can be faithfully considered as an isomorphic representation of the ordinal ! m + n. To see this, we observe that lexicographic pairs of the form (0; n) are isomorphic to the naturals, with (0; n) corresponding to n. The pair (1; 0), like !, is the smallest pair which is bigger than all the pairs in the in nite set (0; n) j n 0 . Our proof relies on the following general theorem. Theorem 3.5 (embedding within the ordinals) Let A be a well-founded ordering over a set S. Then, there exists a (ranking) function : S 7! O such that: (a) s A s0 implies (s) > (s0 ). (b) If (s) = and < , then there exists an element s0 such that (s0 ) = and s A s0 . (c) If s0 A s00 implies s A s00 for every s00 2 S, then (s) (s0 ). The theorem can be proven, using a trans nite construction that assigns a value (s) to an element s, based on the values (s0 ) assigned to all s0 @ s. The constrruction is de ned as follows: (s) = 0 for all A-minimal elements of S, i.e., elements s such that there exists no s0 @ s. For all other s 2 S, (s) is the least upper bound of (s0 ) + 1 for all s0 @ s. Example Consider system LEX presented in Fig. 3.46. Transition 1 of this system sets x to zero and sets y to an arbitrary positive integer value. Transition 1 can be taken only once since it sets x to 0 which disables 1 for any future activation. Transition 2 can be taken as long as y > 0 and always sets y to a nonnegative value which is smaller than its value before the transition. Obviously, any computation of this systems takes 1 once and takes 2 nitely many times until it terminates in the state hx: 0; y: 0i. Assume we wish to prove for this system the following response property. x| = {z y = 1} ) x| = {zy = 0} . p=

1

q



213

V : fx; y : integerg : x = y = 1 T : fI ; 1; 2 g where : x > 0 ^ x0 = 0 ^ y0 > 0 : x = 0 ^ y > 0 ^ x0 = x ^ 0 y0 < y J : f1 ; 2g C: ; 1

2

Fig. 3.46. System LEX.

States of this system consist of pairs of integers (m; n), where m and n are the current values of x and y, respectively. Clearly, the set of Q-states is given by kQk: (1; 1) [ (0; n) j n > 0 : Consider the primary ordering A, holding between (m1 ; n1) and (m2 ; n2) 2 kQk if there exists a fair Q-segment connecting (m1 ; n1) to (m2 ; n2). It can be shown that the order A is given by (m1 ; n1) A (m2 ; n2): (m1 ; n1) (m2 ; n2) ^ m2 = 0 ^ n2 > 0, where is the lexicographic ordering over kQk. The condition m2 = 0 follows from the observation that any fair segment must either take 1 which sets x to 0, implying m2 = 0, or have 1 disabled on some state of the segment, which also implies m2 = 0. The consequence of this condition is that any two states of the form (1; n1) and (1; n2) are unrelated by A. The condition n2 > 0 excludes from consideration the state (0; 0) which satis es q. Applying the described bottom-up construction of the mapping , we observe the following: (0; 1) is the least element of kQk, hence (0; 1) = 0. (0; 2) is the least upper bound of (m; n) + 1 for all (m; n) (0; 2). Since the only element smaller than (0; 2) is (0; 1), we compute (0; 2) = least-upper-bound f1g = 1. In a similar way, we can show that (0; n + 1) = n for every natural n. Next consider (1; 1). State (1; 1) dominates all states (0; n). Consequently, denoting least-upper-bound by l.u.b , we obtain


214


(1; 1) = l.u.b ((0; n + 1)) + 1 j n 2 N

= lub fn + 1 j n 2 Ng = !.

Let us return to the general case of the primary order A holding between states s and s0 if there exists a fair Q-segment connecting s to s0 . Applying the embedding theorem to A, we obtain a mapping from the program states to the ordinals O. The following statement identi es a property satis ed by the mapping .

Property P0 If s 2 kQk and s0 is a P-successor of state s, not satisfying q, then s0 2 kQk and (s) (s0 ). Justi cation From the de nition of Q it follows that if s0 , a P-successor of some s 2 kQk, does not satisfy q it is reachable by a (p; q)-pre x and, therefore, belongs to kQk. Let s00 be such that s0 A s00 . By de nition of A, there exists a fair Q-segment : [s0; : : :; s00]. Obviously, the segment [s; s0 ; : : :; s00] is also a fair Q-segment, implying s A s00. Thus, s0 A s00 implies s A s00 for every s00 . By clause (c) of the embedding theorem, it follows that (s) (s0 ).

The Secondary Ranking We can view the mapping as a rst approximation to our desired ranking function. Unfortunately, it did not remedy our complaint about A being insensitive to ne progress. For example, the mapping , corresponding to the fundamental order presented in Fig. 3.45, is the following. (s3;4) = (s5;4 ) = (s3;6 ) = 1, (s5;6 ) = 0. This primary rank is presented in Fig. 3.47. As we see, there is no observable progress (according to the measure ) when the program moves from s3;4 to s5;4 or from s3;4 to s3;6 . We proceed to de ne a secondary ranking which, together with , will form our nal ranking function. Looking at the diagram of Fig. 3.47, we see that the three states s3;4, s5;4, and s3;6 are situated on a plateau de ned by = 1. However, in the order of execution, s5;4 and s3;6 are \closer to the edge" of the plateau than state s3;4 . How can we measure this closeness? A possible measure could be the \size" of possible paths that are all located within the tableau. Thus, s3;4 is further away from the edge of the plateau since it has a path of length 2, traversing states that all have = 1. States s5;4 and s3;6 are closer to the edge since they only have paths of length 1. In the simple example shown here, we could take the \size" of the path to be simply its length. However, in many cases this is not the right measure, since



?

: 1

s3;4: h: f`3 ; `4 gi

s5;4 : h: f`5 ; `4 gi

s5;6: h: f`5 ; `6 gi : 0

?

215

s3;6 : h: f`3; `6 gi

Fig. 3.47. Q-states of program SKIP2 ranked by .

states may have in nite paths all with the same value of . The relevant \size" of a path in our case is the number of transitions it grati es. For a segment , we de ne the de cit of , denoted by (), to be the smallest natural number i 1 such that i 2= grat (), i.e., i is not grati ed by . If is fair we de ne () = m + 1. We use the de cit as the measure of the \size" of a segment. Note that it is related to the number of transitions grati ed by a segment, since if grat () grat (0 ) then () (0 ). A (Q-)segment : [sa ; : : :; sb ] is called leveled if (sa ) = (sa+1 ) = = (sb ). This corresponds to the previously discussed notion of a segment that is fully contained in a plateau, de ned by the value of (sa ) which is common to all states in the segment. We de ne the height of a state s, denoted by h(s), by n o h(s) = max [s = sa ; : : :; sb ] j (sa ) = = (sb ) : That is, h(s) is the maximal de cit over all leveled segments originating at s. This corresponds to the intuition of the distance from the edge of the plateau along leveled segments.

Example Consider the ranking by on the states presented in Fig. 3.47.

Segments [s3;4; s5;4 ] and [s3;4; s3;6] are leveled. Segments [s5;4 ; s5;6] and [s3;4; s5;4 ; s5;6] are not leveled. There are three leveled Q-segments originating at s3;4 : [s3;4]; [s3;4; s5;4 ], and [s3;4; s3;6]. Segment [s3;4 ] grati es all pair transitions except for 3: `3 and 4 : `4. Consequently, its de cit is [s3;4] = 3. Segment [s3;4; s5;4] grati es all fair transitions except for 4 : `4 . Consequently, its de cit is [s3;4 ; s5;4] = 4. Segment [s3;4; s3;6] grati es all fair transitions except for 3 : `3 . Consequently


216


[s3;4; s3;6] = 3. Taking the maximum over f3; 4g, we obtain the height of s3;4 as h(s3;4 ) = 4. The only leveled Q-segment originating at s5;4 is the singleton segment [s5;4] which grati es all fair transitions except for 4 : `4 and 5 : `X2 . Consequently, h(s5;4 ) = 4. In a similar way, h(s3;6 ) = 3 and h(s5;6) = 5.

The Final Ranking The nal ranking that is intended to satisfy premises FW2 and FW3 combines the primary ranking with the secondary ranking induced by comparing state heights. As the well-founded domain, we take the lexicographic product (A; ): (O; >) [1::m + 1]; > : Thus, elements of A are pairs (; k), where 2 O is an ordinal and k 2 [1::m+1]. The ranking function, mapping states into elements of A, is given by (s): (s); h(s) : This de nition of (s) applies only to states which satis es Q. To complete the de nition, we de ne (s) = (0; 0), for all states that do not satisfy Q. An immediate consequence of this de nition is that (s1 ) (s2 ) for every s1 2 kQk and s2 2= kQk. This is because 0 (s) 0 and h(s) > 0 for every s 2 kQk. Rule WELL-F allows us to have a dierent ranking function i for each i = 0; 1; : : :; m. However, in the proof of completeness we do not use this option, and take i = for all i = 0; : : :; m.

Example We return to program SKIP2. In Fig. 3.48 we present the ordering between the states as determined by the complete rank . As we see in the diagram, states s3;4 and s5;4 have equal ranks (1; 4). This is because they both have = 1 and have height 4. State s3;4 is higher than s3;6 because (s3;4 ) = (s3;6) = 1 but h(s3;4 ) = 4 > 3 = h(s3;6). States s5;4 and s3;6 are higher than s5;6 because (s5;4 ) = (1; 4) > (0; 5) = (s5;6 ) and (s3;6 ) = (1; 3) (0; 5) = (s5;6 ). Thus, the full ranking identi es the step from s3;4 to s3;6 as observable



: (1; 4)

# " ! # R "

217

s3;4 : h: f`3; `4 gi

# "

s5;4: h: f`5 ; `4 gi

s5;6 : h: f`5; `6 gi : (0; 5)

! # R " !

s3;6: h: f`3 ; `6 gi : (1; 3)

!

Fig. 3.48. States of program SKIP2 ranked by .

progress but not the step from s3;4 to s5;4 . The reason for this lack of symmetry will become apparent later. There are several properties that the de ned constructs satisfy.

Property P1 If s 2 kQk then h(s) m. This is because h(s) = m + 1 implies the existence of a leveled Q-segment s = sa ; : : :; sb which grati es all the fair transitions. However, in this case, sa ; : : :; sb is fair and therefore sa A sb , contradicting the assumption that sa ; : : :; sb is leveled.

Property P2 If s; s0 2 kQk and s0 is a successor of s then (s) < (s0 ). Property P0 already established (s) (s0 ). If (s) > (s0 ) we are done. It remains to consider the case (s) = (s0 ) and show that h(s) h(s0 ). Let 0 h(s ) = j. By de nition of the height h, there exists a leveled Q-segment : [s0::sb] such that () = j. The segment e: s; s0 ; : : :; sb is a leveled (s) = (s0 ) Q-segment originating at s. Since e extends , grat (e) grat () and therefore (e) () = j. Since h(s) is the maximal de cit over all leveled Q-segments originating at s, and e is one of them, it follows that h(s) (e) j = h(s0 ), leading to the required inequality.


218


Property P3 If s; s0 2 kQk, h(s) = i, and s0 is a i-successor of s, then (s) (s0 ). By P2, (s) < (s0 ). If (s) > (s0 ), we are done. Therefore, consider the case (s) = (s0 ) and let h(s0 ) = j. Since (s) < (s0 ), it follows that i j. It remains to show that i = 6 j. Assume, to the contrary, that i = j. As before,

let : [s0; : : :; sb ] be a leveled Q-segment realizing the de cit () = j. This means that grati es all fair transitions k , k < j, but does not gratify j . Consider again the extended segment e: [s; s0; : : :; sb ]. This segment grati es all the transitions grati ed by and, in addition, also grati es i = j since i is taken in the step from s to s0 . It follows that (e) > i. This contradicts the de nition of h(s) as being the maximal de cit of all leveled Q-segments originating at s.

The Intermediate Assertions In the next step of the proof, we construct the intermediate assertions '1 ; : : :; 'm , required by rule WELL-F. For each i = 1; : : :; m, we de ne 'i : Q ^ h = i. Thus, 'i is satis ed by all Q-states whose height is precisely i. To complete the de nition, we take '0: q. The following property is a consequence of the de nition of the intermediate assertions.

Property P4 If s 2 kQk, then s satis es one of '1; : : :; 'm. To prove this statement, let s be a state satisfying Q. It has a de ned height h(s) = j which, by P1, is in the range j 2 [1::m]. Consequently, s satis es 'j : Q ^ h = j.

Example For the response property at `3 ^ at `4 )

SKIP2, we obtain

1

at `7 of program

'0 = q : at `7 '1 : at `3;5 ^ at `4;6 ^ h = 1 F | {z }

'2 '3 '4

Q

: at `3;5 ^ at `4;6 ^ h = 2 F : at `3;5 ^ at `4;6 ^ h = 3 at `3 ^ at `6 : at `3;5 ^ at `4;6 ^ h = 4 at `3;5 ^ at `4



219

'5 : at `3;5 ^ at `4;6 ^ h = 5 at `5 ^ at `6 : The assertions are simpli ed based on the full knowledge of the four Q-states and their heights.

1

Claim 3.3 implies that the response formula Q ) q is P-valid. Since 'i : Q ^ h = i implies Q we conclude that for every i = 1; : : :; m, the response formula 'i ) q is also P-valid.

1

Proving the Premises The construction of '0 ; : : :; 'm concludes the development of all the constructs needed for rule WELL-F. We proceed to show that all premises are satis ed by these constructs. All premises, excluding CW4, are implications ' ! that have to be shown as P-state valid. To prove this, it is sucient to show that any P-accessible state satisfying ' also satis es . Premise FW1. This premise requires p !

m _

j =0

'j .

Let s be an accessible state satisfying p. If s satis es q = '0 , we are done. Otherwise, s satis es assertion Q since it is reachable by the singleton (p; q)segment [s]. By P4, s satis es 'j : Q ^ h = j for some j 2 [1::m]. Premise FW2. This premise requires ^ 'i !

m _

('0j ^ 0 ) _ ('0i ^ = 0 ).

j =0 Let s be a state satisfying 'i : Q ^ h = i and let s0 be a -successor of s. If s0 satis es q = '0 , we are done. Otherwise, s0 satis es Q, then, by P4, '0j holds for some j 2 [1::m] and, by P2, (s) < (s0 ) which means that either (s) > (s0 ) or (s) = (s0 ) and h(s) h(s0 ). If (s) > (s0 ) or (s) = (s0 ) and h(s) > h(s0 ), then (s) (s0 ). Otherwise, (s) = (s0 ) and h(s) = h(s0 ) which implies (s) = (s0 ) and that '0i = 'i (s0 ) = Q(s0 ) ^ h(s0 ) = i holds.

Premise FW3. This premise requires i ^ 'i !

m _

j =0

('0j ^ 0).


220


Let s be a state satisfying 'i : Q ^ h = i and s0 a i -successor of s. If s0 satis es q = '0, we are done. Otherwise s0 satis es Q and, therefore, by P4, '0j for some j 2 [1::m]. Also, by P3, (s) (s0 ). Premise FW4 consists of the two subpremises: CW4 and JW4. We consider JW4 rst. Subpremise JW4. This subpremise requires 'i ! En (i ). Let s be a state satisfying 'i : Q ^ h = i. By the de nition of h, there exists a leveled Q-segment : [s; : : :; sb ] whose de cit is () = i. This implies that i is not grati ed in . Transition i must be enabled on s because otherwise, i would have been grati ed in . Subpremise CW4. This subpremise requires a proof of 'i ) :'i _ En (i ): All other premises considered previously were implications of state formulas. Since our statement of completeness is relative to state validities it was enough to show that premises FW2, FW3, and subpremise JW4 are state valid and that premise FW1 is P-state valid. Subpremise CW4 is a temporal formula. Consequently, we have to show that its proof can be syntactically reduced, perhaps using rule WELL-F again, to state and P-state validities. We begin by showing that 'i ) :'i _ En (i ) is P i -valid where P i is the fair transition system obtained from P by removing transition i from the compassion set CP . This is motivated by the observation that, if we are currently at position j where i is disabled and are working towards the rst position k > j where i becomes enabled, then i cannot be taken between j and k. Therefore, the computation segment between j and k is also a computation segment of the simpler system P i . Assume to the contrary, that 'i ) :'i _ En (i ) is not P i -valid. Then, there exists a computation of P i and a position j 0, such that 'i holds and i is disabled at all positions k j. Since i is continually disabled beyond j, is also a computation of the complete system P. In particular, is fair with respect to i which is never taken due to the continual disableness of i . Furthermore, 'i implies Q which implies :q. It follows that q never holds beyond j leading to the fact that Q ) q does not hold on , a computation of P. This contradicts a corollary of Claim 3.3. We therefore conclude that 'i ) :'i _ En (i ) is P i -valid. Next, we show that subpremise CW4 is not only P i -valid but can be proven from

1

1

1

1

1



221

state validities. This is the time to explain to the reader that the completeness proof is done by induction on , the number of compassionate transitions. If = 0 then we are never called to establish subpremise CW4. Therefore all necessary premises and subpremises are state formulas and it is sucient to show that they are state or P-state valid as we have done in the previous discussion. If > 0 then system P i has only 1 < compassionate transitions since i is compassionate. By the induction hypothesis, rule WELL-F is complete for such systems. It follows that the response formula 'i ) :'i _ En (i ) , which has been shown to be P i -valid, is provable by a (recursive use of) rule WELL-F. This concludes the proof of completeness of rule WELL-F for proving response formulas p ) q for the case that p and q are assertions.

1

1

Example We illustrate the generation of the constructs needed for rule WELL-F on an example. In particular, we wish to illustrate the principle of inductive reduction by which compassionate transitions are removed one at a time. Consider program SIMPLE-MUX presented in Fig. 3.49. local y: integer where y = 1 3

2

`0 : while y = 1 do 37 2 6 7 6 ` : y := y 1 1 6 77 6 6 P1 :: 6 4`2 : critical 577 6 `3 : y := y + 1 75 4 `4 :

m0 : request y P2 :: m : 1

Fig. 3.49. Program SIMPLE-MUX. This program can be viewed as a simpli ed version of program MUX-SEM presented in Fig. 3.1. The property in which we are interested is at m1 ; : at m0 ) | {z } | {z } p

1

q

claiming that process P2 eventually terminates. This formula is obviously valid over SIMPLE-MUX. We follow the process outlined in the completeness proof to show how formula can be veri ed over SIMPLE-MUX, using rule WELL-F.


222


Constructing Assertion Q

In this simple case, we can explicitly enumerate the set of accessible states. In Fig. 3.50 we present a state-transition graph which displays the accessible states of program SIMPLE-MUX and the transitions between them.

FF E - 6 E FF ? ? E 6 E

at m0

y: 1 s0;0 : at `0 `0 s1;0 : at `1

at m1

m0

y: 0 s0;1 : at `0

?

`0

m0

s1;1 : at `1

CD -FE

C C - DD C C - DD

y: 0 `1 s2;0: at `2 `2 s3;0: at `3

CD -FE `1

`3

y: 1 s2;1: at `2 `2 s3;1: at `3 `3

s4;1 : at `4 ^ at m1 ^ y = 0

Fig. 3.50. A state-transition graph for program SIMPLE-MUX.

Assertion Q characterizes all the states which are reachable from an accessible (p: at m0 )-state by a (q: at m1 )-free segment. This includes the states kQk: fs0;0; s1;0; s2;0 ; s3;0 g. Therefore, we can take for Q the assertion Q: (at `0;1 ^ y = 1 _ at `2;3 ^ y = 0) ^ at m0 .

Constructs A, , h, , 'i , and i

The fair transitions of program SIMPLE-MUX consist of the just transitions `0 , `1 , `2 , `3 and the compassionate transition m0 . We list them in the following order: F : f 1 : `0; 2 : `1; 3: `2 ; 4: `3 ; 5: m0 g. Examining the graph of Fig. 3.50, where the set kQk occupies the top row of states, we observe that there is no Q-segment which grati es all the ve fair transitions.



223

In particular, no Q-segment grati es 5 : m0. It follows that the order A is empty, i.e., A: ;. This makes the task of computing trivial, leading to (s) = 0 for all s 2 kQk. Next, we compute the height function h(s). Since (s) = 0 for all Q-states, there is a leveled Q-segment departing from each Q-state which grati es the transitions f`0 ; `1; `2 ; `3g. The de cit of such a segment is 5, corresponding to the ungrati ed transition 5 : m0 . We conclude that h(s) = 5 for all s 2 kQk. It follows that the full ranking function is (s) = (0; 5) for all s 2 kQk. Consequently, there exists a single intermediate assertion ' = Q with a corresponding helpful transition = 5: m0 . It is not dicult to check that all the premises of rule WELL-F, except CW4, are P-state valid. It only remains to prove CW4. (at `0;1 ^ y = 1 _ at `2;3 ^ y = 0) ^ at m0 ) |

{z

'=Q

1

}

:Q _ at m0 {z^ y = 1} | En (m0 )

:

Proving CW4

To prove CW4, we reapply rule WELL-F with p 5 = Q: (at `0;1 ^ y = 1 _ at `2;3 ^ y = 0) ^ at m0 q 5 : :Q _ (at m0 ^ y = 1) over program SIMPLE-MUX 5 which is identical to program SIMPLE-MUX, except that 5: m0 is no longer considered compassionate. The removal of m0 from the compassion list does not change the behavior of the program in the segments of interest, but has an eect on the auxiliary constructs.

Assertion Q 5

Assertion Q 5 should characterize all states which are reachable from an accessible p 5 -state by a q 5 -free segment. It is obvious that kQ 5k = fs2;0; s3;0g. Consequently,


224


Q 5 : at `2;3 ^ at m0 ^ y = 0.

Constructs A 5 , 5 , h 5, 5 , 'i 5 , and i 5

Consider the q 5 -free segments departing from Q 5 -states. State s2;0 initiates the segment [s2;0 ; s3;0] which grati es all the remaining four transitions `0 , `1 , `2 , and `3 . Consequently, we set A 5 = (s2;0 ; s3;0 ) which implies s2;0 A 5 s3;0. Computing 5 , we get 5 (s2;0 ) = 1 and 5 (s3;0) = 0. It follows that s2;0 has [s2;0 ] as the only departing leveled Q-segment with de cit 3, corresponding to the ungrati ed transition 3 : `2. State s3;0 has the departing leveled Q-segment [s3;0] with de cit 4, corresponding to 4: `3 . Consequently, we obtain two intermediate assertions with the following associated constructs: i

'i 5

5

Helpful transition i 5

1

at `2 ^ at m0 ^ y = 0

(1; 3)

`2

2

at `3 ^ at m0 ^ y = 0

(0; 4)

`3

It is not dicult to check that all premises of rule WELL-F are satis ed for this choice. Since the two helpful transitions are just, it is only necessary to check subpremise JW4. In Problem 3.4, we ask the reader to apply the construction outlined in the completeness proof to the full mutual-exclusion program MUX-SEM of Fig. 3.1.

Expressing the Constructs by a Formal Language The completeness proof speci ed the necessary constructs by semantic means. We now show that all constructs can be expressed within an appropriate assertional language. We use some of the notation introduced in Section 2.5 of the SAFETY book.

The Kernel Assertion Q

Recall that a state s satis es assertion Q if there exists a P-pre x [s1; : : :; sn ], such that



225

sn = s, and for some k 2 [1::n], sk satis es p, and for all i 2 [k::n], si does not satisfy q.

We use the notations introduced in Section 2.5 of the SAFETY book to express Q for the case that the system variables of program P, y = fy1; : : :; yr g, range over data domains that are either natural numbers or encodable as natural numbers. We use a two-dimensional dynamic array a 2 A2 (N) to encode sequences of states intended to represent pre xes and segments. The complete formula is given by Q(y): 9n > 0: 9a 2 A2 (N): reach (y) ^ 9k 2 [1::n]: p(a[k]) ^ q-free ; where

reach (y): jaj = (n; r) ^ a[1] ^ a[n] = y ^ evolve (a; n) _ evolve (a; n): 8i(1 i < n): a[i]; a[i + 1] 2T q-free : 8i 2 [k::n]: :q a[i] : The free variables in Q are the list of system variables y = y1 ; : : :; yr , representing

the current state.

Segments and the Transitions they Gratify

In the following discussion we use two-dimensional dynamic arrays b 2 A2(N) of shape jbj = (n; r) to represent segments. The formula Qseg (b; n; u) states that b encodes a Q-segment of length n, originating at state u Qseg (b; n; u): jbj = (n; r) ^ b(1) = u ^ evolve (b; n) ^ 8i 2 [1::n]: Q b[i] : The formula gratify (b; i) states that segment b grati es transition i : gratify (b; i): 9j 2 [1::n 1]: i b[j]; b[j + 1] _ i 2 C ^ 8j 2 [1::n]: :En i ; b[j] _

i 2 J C ^ 9j 2 [1::n]: :En i ; b[j] ;

where

En (i ; y): 9y 0 : i (y; y0 ). The formula fair (b) states that segment b is fair, i.e., grati es all fair transi-

tions


226


fair (b):

m ^ i=1

grat (b; i).

The Primary Order A Recall that s1 A s2 if there exists a fair Q-segment leading from s1 to s2 . Representing the state-variables at s1 and at s2 by u and v, respectively, we de ne the corresponding formula u A v u A v: 9n > 0: 9b 2 A2 (N): Qseg (b; n; u) ^ b[n] = v ^ fair (b) : The Primary Ranking

When we attempt to express the primary ranking , we nd that the assertional language we used so far, a rst-order language over the integers, is no longer adequate. Our failure to express the ranking by a rst-order language is not accidental and there are theoretical arguments which shows that some extensions to the rst-order language are necessary. The extension we choose is one which leads to the most natural formalization of the construction of . We allow least xed points over recursive function de nitions. With this extension we can express the ranking as the least xed point of the recursive equation F(u) = lub F(v) + 1 j v @ u : Note that if u represents a A-minimal state, then the least upper bound is taken over an empty set. The least ordinal which is bigger than all elements of the empty set is 0. This shows that (s) = 0 for all A-minimal states s.

Expressing the Height of a State

The formula Lseg (b; n; u) identi es array b as representing a leveled Q-segment of length n, originating at state s, which is represented by system variables u. Lseg (b; n; u): Qseg (b; n; u) ^ 8i 2 [1::n 1]: a[i] = a[i + 1] : The formula has-def (u; j) states the existence of a leveled Q-segment originating at u with de cit j 2 [1::m] has-def (u; j): 9n > 0 9b 2 A2 (N): Lseg (b; n; u) ^ :gratify (b; j) ^ ^ gratify (b; k). k<j

That is, j is not grati ed in b but every k , 1 k < j, is grati ed in b. The height function h(u) can now be written as follows h(u): max j 2 [1::m] j has-def (u; j) :


3.9 Completeness: General Response

227

This formula computes the maximal de cit over all leveled Q-segments departing from u.

The Final Rank and Assertions

The nal rank is given by (u): (u); h(u) : The intermediate assertions 'i (u), i = 1; : : :; m, can be expressed by the following 'i (u): Q ^ h(u) = i.

** 3.9 Completeness:

General Response

1

In the general case, we consider a response formula p ) q, where p and q are past formulas. In this case, the intermediate formulas '1 ; : : :; 'm are also past formulas and all premises are to be written as entailments ). Note that the ranking function may also depend on the past.

Example As our running example for the general case, consider system INC presented in Fig. 3.51 (see also Fig. 4.2 of the SAFETY book). V: : T: J: C:

fx: integerg

x = 0 fI ; g where : x0 = x + 1 f g

fg

Fig. 3.51. System INC.

Q

1Q

We wish to establish for it the response property (x = 5) ) (x = 10). This property states that every position that has x = 5 in its past is followed by a position that has x = 10 in its past.


228


The strategy we intend to follow in proving completeness for the general case is identical to the one followed in Section 4.9 of the SAFETY book, where we established completeness for past invariances. Namely, given a response formula p ) q, where p and q are past formulas, and a program P, we construct stati ed versions of p, q, and P, denoted by pb, b respectively. Assuming that p ) qb, and P, q is P-valid, we conclude that b pb ) qb is P-valid. We invoke the proof of completeness for response over b state formulas to construct intermediate assertions 'b1 ; : : :; 'bm and ranking , satisfying premises FW1, FW2, FW3, and FW4 of rule WELL-F. As a last step we unstatify 'b1 ; : : :; 'bm, and b to obtain past formulas '1 ; : : :; 'm and a (possibly) past dependent ranking . Since these steps are very similar to the corresponding steps taken in Section 4.9 of the SAFETY book, we provide only a sketch and concentrate on a few minor dierences between the two cases.

1

1

1

Statifying p, q, and Program P

The base for stati cation in Section 4.9 of the SAFETY book was the closure which contains all subformulas of whose principal operator is a past operator. Here, we need to statify both p and q at the same time. Consequently, we base stati cation on the set p;q which contains all subformulas of p and q with a past principal operator. Using p;q we statify p, q, and P.

Q Q

Example Consider property | (x{z= 5)} )

Q

p

1Q |

(x{z= 10)} for system INC. The q

closure of p and q is given by p;q : (x = 5); (x = 10) : The stati cation transformation can be de ned as stat ('): ' b5 = (x = 5); b10= (x = 10) : Consequently, we have pb: b5 and qb: b10. The stati ed system Id NC is presented in Fig. 3.52. Thus, we have reduced the task of proving (x = 5) ) INC to the task of proving b5 ) b10 over d INC.

Q

1

Q

Q

1

1Q

(x = 10) over

Invoking the Completeness Proof for State Response b we invoke the completeness proof Faced with the task of verifying pb ) qb over P,

for state response formulas. This invocation results in intermediate assertions 'b1 ; : : :; 'bm , and ranking b satisfying premises FW1, FW2, FW3, and FW4 of rule WELL-F.


3.9 Completeness: General Response

229

Vb : fx: integer; b5 ; b10: booleang b : x = 0 ^ b5 = b10 = F Tb : fbI ; bg with transition relation (after simpli cation) b : x0 = x + 1 ^ b05 = (x = 4 _ b5 ^ b010 = (x = 9 _ b10 Jb: fbg Cb: ; Fig. 3.52. Stati ed system d INC.

Example Applying the completeness proof to property b5 )

1

b10 over system d INC may result in a single intermediate assertion 'b and the ranking b ': b x 0 ^ (b5 $ x 5) ^ (b10 $ x 10) ^ (b5 ^ :b10) b (x; b5; b10): if 'b then (9 x; 1) else (0; 0). Note that if we were doing a manual proof of the considered property, it would b have been sucient to take 5 x < 10 for 'b and max (9 x; 0) for (x). The b constructs 'b and displayed above are (equivalent to) the ones that are actually constructed by the completeness proof. For example, they only allow accessible states in '. b

1

b the state-response comBesides providing the constructs 'b1 ; : : :; 'bm , and , pleteness proof provided us with a detailed deductive proof of pb ) qb over b This proof consists of repeated applications of rule WELL-F, which program P. b establish the P-state validity of various instances of premises FW1, FW2, FW3, and subpremise JW4, all of which are state implications. Consequently, the steps b in the proof of Pb pb ) qb alternate between establishing the P-state validity of a state implication and invocations of rule WELL-F.

q 1

Unstatifying

As the nal step, we unstatify the constructs 'b1 ; : : :; 'bm , and b into '1 ; : : :; 'm , and . Subsequently, we show that each of the premises, previously shown to be a b P-state valid implication, is transformed into an entailment of past formulas which can be shown to be P-valid using inverse stati cation, rule IGEN, and entailment reasoning. This step is very similar to the corresponding step in Section 4.9 of the SAFETY book. Details are therefore omitted here. Example Unstatifying the obtained constructs for system d INC, we obtain the following


230


': x 10 ^

Q

(x = 5) $ x 5 ^

Q Q$ (x = 10)

(x): if ' then (9 x; 1) else (0; 0).

Q

x 10 ^ (x = 5) ^ : (x = 10)

3.10 Finite-State Algorithmic Veri cation: State Response

1

In this and the next section we present an algorithm for checking whether a nitestate program satis es a response property p ) q. Consistent with our general strategy, we consider in this section the case that p and q are assertions. In the next section, we study the extensions necessary to handle the more general case in which p and q may be general past formulas. The algorithm searches for a counter-example. That is, it looks for a computation and a position j 0 such that p holds at j but q holds at no position k j. Even for nite-state programs, a computation is an in nite object and, usually, there are uncountably many dierent computations. Consequently, we cannot simply enumerate all possible computations and check each of them for being a counter-example. Instead, we will analyze the state-transition graph GP , which is always nite for a nite-state program P. Recall that GP is a graph containing all the P-accessible states as nodes, and edges connecting s1 to s2 if s2 is a successor of s1 for some 2 T . In this section, we only consider states appearing in GP . Therefore, any reference to a state s implies that s is P-accessible. Let be a computation. De ne Inf (), called the in nity set of , to be the set of states that appear at in nitely many positions of . Since there are only nitely many P-accessible states, there exists a position f 0 in such that s 2 Inf () if and only if s = sj for some position j f in . Recall that a subgraph S GP is called a strongly connected subgraph (SCS) if, for every two distinct states s1 ; s2 2 S, there exists a path in S, leading from s1 to s2 . Since Inf () contains only P-accessible states, we can view it as a subgraph of GP , called the subgraph induced by .

Claim 3.6 (from computations to subgraphs) Inf () is an SCS.

Justi cation Let s; sb 2 Inf () be two dierent states. Since s 2 Inf (), there exists a position j f such that sj = s. As bs also appears in nitely many times



231

in , there exists a later position k > j such that sk = sb. Consider the segment s=sj ; sj +1 ; : : :; sk =sb in . For every i 2 [j::k], i f. Consequently, si 2 Inf () for every i 2 [j::k] and the path [sj ; : : :; sk ] leading from s to bs is contained in Inf ().

Example Consider system INC2 presented in Fig. 3.53.

V : x: [0::7] : x = 0 T : fI ; 1 ; 2; 3g where : x0 = x 8 1 : even (x) ^ x0 = x 8 2 : odd (x) ^ x0 = x 8 2 J : f1 ; 2g C : f3g 1

2

3

Fig. 3.53. System INC2. In Fig. 3.54, we present the state transition graph for INC2. Consider the computation : s0 [s2 ; s4 ; s6 ; s0 ]k [s2; s3 ; s5 ; s7 ; s0 ]! which consists of s0 , followed by k 0 repetitions of the segment [s2 ; s4; s6 ; s0 ], followed by in nitely many repetitions of the segment [s2 ; s3; s5 ; s7 ; s0]. Independent of how large k is, Inf () = fs0 ; s2 ; s3 ; s5 ; s7 g since these are the states that appear in nitely many times in .

Fair Subgraphs Not every SCS can be obtained as the in nity set Inf () of a computation . Consider, for example, the set S: fs0 ; s2 ; s4; s6 g of Fig. 3.54. This set cannot be the in nity set of a computation. This is because every sequence such that Inf () = S has transition 1 continuously enabled and never taken beyond position f (the position such that sj 2 Inf () for every j f). Thus, any run such that Inf () = S is necessarily unjust towards transition 1 . Consequently, we characterize those SCS's that can be Inf () for some computation .


232

t? 6


?

1 s : hx: 1i 1 3

?

1 s : hx: 0i 0 2

6

1 3 s : hx: 7i 7

- 6 -? 6 -?

s2 : hx: 2i 2 1

2

1 s6 : hx: 6i

3 s5 : hx: 5i 1

s3 : hx: 3i 3 1

2 s4 : hx: 4i 1

Fig. 3.54. State transition graph for INC2.

Let S be a subgraph of GP and a transition. We say that is taken in S if S contains two states, s1 and s2 , such that s1 is connected by a directed edge to s2 and s2 2 (s1 ). Transition is said to be enabled (disabled ) in S if there exists an s 2 S such that is enabled (disabled) on s. A subgraph S is called just if every just transition 2 J is either taken in S or is disabled in S. For example, subgraph fs0 ; s1 ; s3 ; s5; s7 g of Fig. 3.54 is just. It is just towards 1 because s1 2 1 (s0 ). It is just towards 2 since 2 is disabled on s1 . As previously observed, subgraph fs0 ; s2 ; s4; s6 g is not just towards 1 , which is enabled on all of its states but not taken. A subgraph S is called compassionate if every compassionate transition 2 T is either taken in S or is not enabled in S. Not enabled means that is disabled on all states s 2 S. For example, subgraph fs0 ; s2 ; s4 ; s6g is compassionate but not just. It ful lls



233

its obligations to the only compassionate transition 3 , since 3 is disabled on all states in the subgraph. On the other hand, subgraph fs0 ; s1 ; s2 ; s4; s6 g is just but not compassionate. This is because 3 is enabled on state s1 of the subgraph but is not taken in the subgraph. A subgraph is called fair if it is both just and compassionate. Thus, subgraph fs0 ; s1 ; s3; s5 ; s7g of Fig. 3.54 is fair.

Traversing Cycle Let S be an SCS of GP . A path : [sa ; : : :; sb ] in the subgraph S is called a traversing cycle of S if it satis es the following requirements: sa = sb . For every s 2 S, s = si for some i 2 [a::b]. For every pair of states s; bs 2 S that are connected by an edge, there exists an i 2 [a::b 1] such that s = si and bs = si+1 . Thus, visits every state s 2 S at least once and traverses every edge connecting two states in S at least once. Consider, for example, subgraph fs0 ; s1 ; s2; s4 ; s6 g. The shortest traversing cycle originating at s0 is s0 ; s1 ; s2 ; s4 ; s6 ; s0 ; s2 ; s4 ; s6 ; s0 . Note that we have to go twice around the subgraph in order to traverse both edge hs0 ; s1 i and hs0 ; s2 i. It is not too dicult to see that every SCS with n nodes has a traversing cycle whose size has a worst case complexity of O(n3 ). The following claim establishes a correspondence between computations and fair subgraphs.

Claim 3.7 (fair SCS's and computations)

An SCS is the in nity set of a computation i it is fair.

Justi cation Let be a computation and S = Inf () its in nity set. We will show that S is fair. Consider a just transition 2 J . Being a computation, is just towards which means that either is disabled on a state s and s = si for in nitely many i's, or there exists a pair of states sb 2 (se) such that es = si and bs = si+1 for in nitely many i's. In the rst case, s 2 S and, therefore, is disabled in S. In the second case, both es; bs 2 S and is taken in S. We conclude that S is just.


234


Next, consider a compassionate transition 2 T . As is compassionate towards , either is continually disabled from some point on, or is taken in nitely many times in . In the rst case, is disabled on all states in S = Inf (). In the second case, S contains a pair of states sb 2 (se), which means that is taken in S. We conclude that S is compassionate. Consequently, S = Inf () is fair. In the other direction, consider a fair strongly connected subgraph S. Let it have the traversing cycle sa ; : : :; sb = sa . Since all states in GP are accessible, there exists a path s0 ; s1 ; : : :; sa leading from some initial state s0 to sa . Consider the state sequence : s0 ; : : :; sa ; [sa+1 ; : : :; sb ]! which consists of the initial pre x s0 ; : : :; sa followed by endless repetition of the segment sa+1 ; : : :; sb . It is not dicult to verify that is a computation of program P. In particular, the fact that satis es the requirements of justice and compassion follows from the fairness of S and the property that sa ; : : :; sb visits every state in S and traverses every edge in S at least once. For example, an INC2-computation such that Inf () = fs0 ; s1 ; s3 ; s5; s7 g can be given by : s0 ; [s1 ; s3 ; s5 ; s7 ; s1 ; s3 ; s5 ; s7 ; s0 ]! . Computation satis es the fairness requirement by taking 1 and 3 in nitely many times. Just transition 2 is not taken at all, but this is allowed since it is in nitely often disabled | at all visits to states s1 , s3 , s5 , and s7 .

Subgraphs Corresponding to Counter-Examples The correspondence between computations and fair SCS's raises the possibility that instead of examining uncountably many computations we may have to inspect only the fair subgraphs of GP , whose number is nite. A path [sa; : : :; sb ] in graph GP is called q-free, if si satis es q for no i 2 [a::b]. A state s is called q-pending if there exists a q-free path [sa ; : : :; sb ] such that sb = s and sa satis es p. Assume that property p ) q is P-valid. An important property of qpending states is that if state si in a computation of P is q-pending it must be followed by a later state sj , j > i, satisfying q. The reason for this is that these

1



235

1

states characterize situations in which we have already observed an occurrence of p but not yet the corresponding q, promised by the P-validity of p ) q. In that respect, they generalize the family of p-states, since for all of these states there is still a pending occurrence of q.

1

Example Consider the response property 5| {z x 6} x| {z = 0} )

p q for system INC2 (Fig. 3.53). The set of q-pending states for this choice of p and q

is

fs0; s1 ; s2 ; s3 ; s4 g.

States s5 and s6 are not included since they satisfy q. State s7 is not included since every path connecting s0 to s7 must pass through either s5 or s6 .

1 1

When we want to check whether p ) q is P-valid, we refer to a computation that does not satisfy p ) q as a counter-example . It is not dicult to see that is a counter-example i all states from a certain position on are q-pending i all states in Inf () are q-pending. Since we are interested in counter-examples, we de ne the Q-graph of program P, denoted QP , to be the subgraph of GP consisting of the q-pending states in GP . The following algorithm describes an ecient calculation of QP , given GP .

Algorithm Q-GRAPH (calculation of QP )

Let QP be a copy of GP . Remove from QP all q-states. Remove from QP all states not reachable from a p-state.

Example Let us calculate QP for system INC2 for p: x = 0 and q: 5 x 6. As a rst step, we remove the q-states s5 and s6 . Next we identify the preachable states by successive marking. This procedure marks states according to the sequence s0 , s1 , s2 , s3 , s4 . State s7 remains unmarked and is removed. We remain with QP : fs0 ; s1; s2 ; s3 ; s4g. The preceding discussion and sequence of claims lead to a conclusion that is summarized by the following proposition.

Claim 3.8 (checking for validity)

The graph QP contains a fair SCS i the property p )

1

q is not P-valid.


236


Justi cation Assume that QP contains a fair SCS S. Following the construction

described in Claim 3.7, there exists a P-computation such that Inf () = S. Since all but nitely many states in are q-pending, is a counter-example which violates p ) q. In the other direction, if is a counter-example which violates p ) q then S = Inf () is a fair SCS of GP consisting of q-pending states. Consequently, it is also a subgraph of QP .

1

1

p

1

p

1

Example Consider the property = 4} ': x| {z = 0} ) |x {z q

for program INC2 (Fig. 3.53). We wish to check whether property ' is P-valid. Calculation of QP shows that all states, excluding s4 , are q-pending. Consequently, by Claim 3.8, ' is valid over INC2 i there does not exist a fair SCS of QP = GP fs4 g. Obviously, fs0 ; s1; s3 ; s5 ; s7g is such a subgraph. We conclude that (x = 0) ) (x = 4) is not valid over INC2 and can actually point to the computation : [s0; s1 ; s3 ; s5 ; s7 ]! as a counter-example. On the other hand, let us consider another property : x| {z = 0} ) odd (x) : | {z }

1

q Calculating QP we obtain QP : fs0 ; s2 ; s4; s6 g. The only SCS of QP is QP itself. However, QP is not fair since the just transition 1 is enabled on all states of QP

but is not taken in QP . We conclude that (x = 0) )

1

odd (x) is valid over INC2.

In principle, we can consider the problem solved. Since QP contains only nitely many subgraphs, and each can be checked for being strongly connected and fair in a nite number of steps, we can suggest an algorithm based on this procedure. Unfortunately, the resulting algorithm will not be very ecient, since a graph of size n may contain an exponential number of SCS's. We therefore study a more ecient algorithm.

An Ecient Algorithm Let S be a strongly connected graph. We wish to check whether S is fair or contains a fair SCS.



237

It is straightforward to check whether S is just. For each 2 J , we check that is disabled in S or taken in S. If S is not just then no subgraph of S can be just. To see this, we observe that if some subgraph S 0 S treats justly, that is, is disabled or taken in S 0 , then so does S. Consequently, if S 0 S is just then so is S and, equivalently, if S is unjust it cannot contain a just subgraph. Assume we found S to be just. Next, we check whether S is compassionate, i.e., if it is the case that every compassionate transition 2 C is either taken in S or is disabled on all states of S. If S is compassionate, we conclude that it is fair. However, if S is not compassionate it may still, unlike the justice case, contain a compassionate subgraph. For example, considering graph GP of Fig. 3.54, the subgraph S: fs0 ; s1; s2 ; s4 ; s6 g is not compassionate towards 3 which is enabled on s1 but not taken in S. On the other hand, the subgraph of S, S 0 : fs0 ; s2; s4 ; s6 g is compassionate since 3 is disabled on all of its states. If S was found to be uncompassionate, there exists some transition k 2 C which is not taken in S but is enabled on some states in S. Let EN (k ; S) denote the set of S-states on which k is enabled. Clearly, no compassionate subgraph S 0 S can contain any of these states. Therefore, it is safe to remove EN (k ; S) from our consideration. Let U = S EN (k ; S). We should check whether U contains a fair SCS. Removing the set EN (k ; S) from S may lead to a subgraph U which is no longer strongly connected. Therefore, before proceeding, we decompose U into a sequence of maximal strongly connected subgraphs (MSCS's) U1 ; : : :; Uk . There exist several ecient algorithms for such decomposition, and we refer by the generic name DECOMPOSE to any of them. We used such an algorithm already in Section 3.6 of the SAFETY book. We proceed to test recursively each Ui , i = 1; : : :; k, checking whether it contains a fair SCS. We summarize these steps in algorithm FAIR-SUB which accepts as input an SCS S and produces as an output a fair SCS S 0 S if one exits, or the empty set ; if S does not contain a fair SCS.

Algorithm FAIR-SUB (fair SCS's) Recursive Algorithm fair-sub (S: subgraph) returns subgraph If S is not just return ; | failure If S is compassionate return S | S is fair Otherwise, there exists 2 C such that is not taken in S and EN (; S) 6= ; Let U = S EN (; S) Decompose U into MSCS's U1 ; : : :; Uk For each i = 1; : : :; k do if Vi = fair-sub (Ui ) 6= ; then return Vi

| fair subgraph


238


end-for return ;.

| no fair subgraphs.

Justi cation It is not dicult to see that if fair-sub (S) returns a nonempty subgraph S 0 S then S 0 is fair. We concentrate on showing that if S contains a fair subgraph S 0 S then fair-sub (S) returns some fair subgraph S 00 S, which need not be identical to S 0 . We prove this by induction on n = jS j, the number of states in S. For jS j = n = 1, S can contain a fair subgraph S 0 S only if S 0 = S itself is

fair. For this case, the rst two tests in fair-sub will nd that S is both just and compassionate and return it as the result. Assume that the inductive claim is true for all subgraphs of size not exceeding n, and consider a subgraph S of size n + 1 that contains a fair subgraph S 0 S. If S itself is fair then fair-sub will return S after the rst two tests. Otherwise, the algorithm will nd S to be just but not compassionate and identify a compassionate transition 2 C which is not taken in S and such that En (; S) 6= ;. Subgraph S 0 being fair, it must treat with compassion, which implies that S 0 cannot contain any state s 2 En (; S). Consequently, S 0 is contained in U = S En (; S). Decomposing U into MSCS's U1 ; : : :; Uk , we observe that S 0 , which is strongly connected, must be fully contained in Uj , for some j 2 [1::k]. Since jUj j jS En (; S)j < n + 1, the induction hypothesis holds for Uj which contains a fair subgraph. Consequently, if the algorithm does not return a nonempty result for some i < j, it will invoke fair -sub (Ui ) and obtain, by the induction hypothesis, a nonempty fair subgraph Vi as a result. This Vi is the result of fair -sub (S).

Example Consider the state-transition graph presented in Fig. 3.55. are

This graph represents a nite-state fair transition system whose fairness sets

J : f1g C : f2 ; 3 g.

1

We wish to check whether the property x| {z = 5} x| {z = 0} ) p

q

is valid over system ROUND. As a rst step, we identify the set of q-pending states, which is QP : fs0 ; s1 ; s2; s3 ; s4 g. Since QP is strongly connected we can apply Algorithm FAIR-SUB. We nd that QP is just but not compassionate. In particular it does not treat 3 with compassion. Transition 3 is enabled on s3 but not taken in QP . Consequently, we consider U = QP En (; QP ) = QP fs3 g = fs0 ; s1 ; s2; s4 g. Subgraph U is not strongly connected and it is decomposed, using


I

R


- s0: hx: 0i 1

s1 : hx: 1i

2

1 s2 : hx: 2i

2

239

R

s3 : hx: 3i 2 3

1 s4 : hx: 4i

Fig. 3.55. System ROUND.

s5 : hx: 5i

Algorithm DECOMPOSE, into the MSCS's U1 : fs4 g and U2 : fs0 ; s1 ; s2 g. In the next step, we apply FAIR-SUB to U1 : fs4 g. This subgraph is not just since 1 is enabled on all of its states but not taken in U1 . Consequently, fair-sub fs4 g returns ;, denoting a failure to locate a fair SCS within U1 . Applying FAIR-SUB to U2 : fs0 ; s1 ; s2 g we observe that this subgraph is both just and compassionate and is therefore fair. It is compassionate towards 3 by having 3 disabled on all states of U2 . We therefore conclude that property x = 0 ) (x = 5) is not valid over system ROUND. A counter-example is provided by any sequence that endlessly traverses U2 . For example, : [s0 ; s1 ; s2]! is a computation not satisfying x = 0 ) (x = 5).

1

1

We can now combine all the constituents into algorithm STATE-RESP for checking validity of a response formula over a nite state system.

1

Algorithm STATE-RESP (algorithmic veri cation of state formulas) To check whether formula ': p ) q is valid over nite-state system P, Construct the state-transition graph GP . Construct QP , the graph of q-pending states, using Algorithm Q-GRAPH. Decompose QP into MSCS's S1 ; : : :; St . For each i = 1; : : :; t, apply fair-sub (Si ). If any of these applications returns with a nonempty result, formula ' is not P-valid. A counter-example can be constructed from the returned


240


fair subgraph. If all applications return the empty set as result, formula ' is P-valid.

Example (checking accessibility for MUX-SEM)

Let us consider the nite-state program MUX-SEM of Fig. 3.56 (see also Fig. 3.1). We wish to model-check whether it satis es the property of accessibility

local y: integer where y = 1 3

2

`0 : loop forever do 3 2 6 6 `1 : noncritical 777 6 P1 :: 66 66`2 : request y 7777 77 6 6 55 4`3 : critical 4 `4 : release y

3

2

m0 : loop forever do 3 2 6 6 m1 : noncritical 777 6 P2 :: 66 66m2 : request y 7777 77 6 6 55 4m3 : critical 4 m4 : release y

Fig. 3.56. Program MUX-SEM (mutual exclusion by semaphores). at `2 ) | {z } p

1

at `3 : | {z } q

We already model-checked this program for the safety property of mutual exclusion in Section 2.6 of the SAFETY book. During this check we constructed the state-transition graph for MUX-SEM as presented in Fig. 2.27 of the SAFETY book. Following algorithm STATE-RESP, we construct QP , the graph of q-pending states for p: at `2 and q: at `3 . This graph is presented in Fig. 3.57. Analyzing the strongly connected graph QP , we nd that it is just but not compassionate, since the compassionate transition `2 is enabled on states s0 , s1 , and s2 . Removing these states, we are left with two SCS's fm3 g and fm4 g. Neither of these subgraphs is just. Transition m3 is enabled but not taken in fm3 g and transition m4 is enabled but not taken in fm4 g. Thus QP contains no fair SCS. We conclude that at `2 ) at `3 is valid over program MUX-SEM.

1

Example (checking accessibility for MUX-PET1)

Consider program MUX-PET1 of Fig. 3.58 (see also Fig. 1.13). In Section 2.6 of the SAFETY book we analyzed its safety property of mutual exclusion and constructed in Fig. 2.28 of the SAFETY book its state-transition graph.



6

`3 s0 : hf`2 ; m0 g; 1i m0

6

6

-

`3 s1 : hf`2 ; m1 g; 1i m1

m4 s : hf` ; m g; 0i 4 2 4

241

6

`3 s2 : hf`2 ; m2 g; 1i m2

?

m3 s : hf` ; m g; 0i 3 2 3

Fig. 3.57. Graph QP of q-pending states of program MUX-SEM.

local y1 ; y2 : boolean where y1 = y2 = F s : integer where s = 1 3

2

`0 : loop forever do 37 2 6 ` : noncritical 7 6 1 6 6` : (y ; s) := (T; 1) 77 6 1 77 P1 :: 66 66`2 : await 77 : y _ s = 6 1 77 6 3 2 6 77 6 6 57 4`4 : critical 5 4 `5 : y1 := F 3

2

m0 : loop forever do 37 2 6 m1 : noncritical 7 6 6 6m : (y ; s) := (T; 2) 77 7 6 2 2 P2 :: 66 66m : await :y _ s 6= 27777 77 6 3 1 6 77 6 6 55 4m4 : critical 4 m5 : y2 := F Fig. 3.58. Program MUX-PET1 (Peterson's algorithm) | version 1.

1

Here we wish to check the response property of accessibility at `2 ) at `4 | {z } | {z } p

q


242


over program MUX-PET1. In Fig. 3.59 we present graph QP of q-pending states for p: at `2 and q: at `4 as extracted from the graph of Fig. 2.28 of the SAFETY book. Each node in this graph is a triple (i; j; k) representing a state in which : fì ; mj g and s: k.

-

(2,0,2) m-0 (2,1,2) m-1 (2,2,2) m2 - (2,3,2) m-3 (2,4,2) m-4 (2,5,2) m5 `2 `2 `2 `2 `2 `2 ? ? ? ? ? ? - (3,0,1) m-0 (3,1,1) m-1 (3,2,1) m2 (3,3,1) m-3 (3,4,1) m-4 (3,5,1) m5 `3 `3 `3

?

?

?

- (3,3,2) `3

?

Fig. 3.59. Graph QP of q-pending states for MUX-PET1. Decomposing QP into a sequence of MSCS's, we obtain the following list S1 : (2; 0; 2); (2; 1; 2); (2; 2; 2); (2; 3; 2); (2; 4; 2); (2; 5; 2) , S2 : (3; 3; 1) ; S3 : (3; 4; 1) ; S4 : (3; 5; 1) ; S5 : (3; 0; 1) ; S6 : (3; 1; 1) ; S7 : (3; 2; 1) ; S8 : (3; 3; 2) : None of these subgraphs is just. Subgraph S1 is not just because `2 is enabled on all of its states and not taken in S1 . Subgraphs S2 , S3 , and S4 are unjust because transitions m3 , m4 , and m5 are enabled but not taken in them. Each of S5 , S6 , S7 , or S8 is unjust because transition `3 is enabled but not taken in it. We conclude that the accessibility property at `2 ) at `4 is valid over program MUX-PET1.

1

3.11 Finite-State Algorithmic Veri cation: General Response



243

1

Algorithm STATE-RESP can be applied for algorithmic veri cation of a formula : p ) q over a nite-state program P for the case that p and q are assertions. Here, we consider the more general case that p and q are past formulas. Algorithmic veri cation of general response formulas is based on extending algorithm STATE-RESP to analyze the reachable atoms graph A P; instead of the state-transition graph GP . Recall from Section 4.10 of the SAFETY book that A P; is a graph of atoms where each atom 2 A has the form : hs; 'b1 ; : : :; 'bnn i consisting of a state s and assignment of truth-values to each past formula 'i belonging to the pastclosure of formula . (

)

(

)

1

1

Example Consider system INC2 presented in Fig. 3.54 and the response property even (x) ^ odd (x) : x| {z = 0} ) | {z } p

q

claiming that any state satisfying x = 0 is followed by an even state (a state in which x is even) which is immediately preceded by an odd state. The past-closure for this case is : odd (x) since odd (x) is the only subformula of with a principal past operator. Consequently, we construct in Fig. 3.60 the graph A P; of reachable atoms, using the algorithm presented in Section 4.10 of the SAFETY book. Given an atom 2 A P; , we can evaluate formulas p and q on since provides an interpretation (T or F) to each subformula of p or q. Consequently, we refer to an atom as a p-atom or a q-atom if the evaluation of p or q on yields T. In analogy with the assertional case, we say that a path a ; : : :; b in A P; is q-free if no i , i 2 [a; b] is a q-atom. An atom 2 A P; is called q-pending if there exists a q-free atom path a; : : :; b = such that a is a p-atom. We de ne QA to be the subgraph of all q-pending atoms in A P; . It can be calculated by an algorithm analogous to Q-GRAPH replacing all references to states, p-states, and q-states, by atoms, p-atoms, and q-atoms.

(

(

(

)

)

)

(

)

(

)

Example In Fig. 3.61 we present QA the subgraph of q-pending atoms for system INC2, p: x = 0, and q: even (x) ^ odd (x).

The notions of just, compassionate, and fair subgraphs extend naturally to subgraphs of atoms. Algorithm GENERAL-RESP generalizes algorithm STATE-RESP to the case that p and q are past formulas.


244

t ? ? R - ? U R - ? U R - ? U


1

0 : x: 0; 2

: x: 0; : odd (x) 2 0 1

1 : x: 1; : odd (x) 1 3

1

2 : x: 2; 2

: x: 2; : odd (x) 2 2 1

3 : x: 3; : odd (x) 1 3

1

4 : x: 4; 2

5 : x: 5; : odd (x) 1 3

3 : x: 3;

: x: 4; : odd (x) 2 4 1

1 : x: 1;

5 : x: 5;

1

6 : x: 6; 2

: x: 6; : odd (x) 2 6 1 7 : x: 7; : odd (x) 1 3

? ? ?

odd (x)

odd (x) 3 1

odd (x)

odd (x) 3 1

odd (x)

odd (x) 3 1

odd (x)

7 : x: 7; odd (x) 1 3

Fig. 3.60. Graph A P; of reachable atoms for INC2. (

)

Algorithm GENERAL-RESP (algorithmic veri cation of general response for-

mulas) To check whether formula : p ) valid over a nite-state system P.

1

q, where p and q are past formulas, is


t ? ? R - ? R U - ? U R - ? U ?


245

: x: 0; : odd (x) 2 0 1

1 : x: 1; : odd (x) 1 3

1 : x: 1;

3 : x: 3;

: x: 4; : odd (x) 2 4 1

5 : x: 5; : odd (x) 1 3

5 : x: 5;

odd (x) 3 1

?

7 : x: 7; odd (x) 1 3

Fig. 3.61. Graph of q-pending atoms for INC2.

Construct A P; the graph of reachable atoms for P and . Calculate QA the graph of q-pending atoms. Decompose QA into MSCS's A1 ; : : :; At. For each i = 1; : : :; t, apply fair-sub to Ai . (

)

odd (x) 3 1

?

: x: 6; : odd (x) 2 6 1 7 : x: 7; : odd (x) 1 3

?

odd (x) 3 1

?

: x: 2; : odd (x) 2 2 1

3 : x: 3; : odd (x) 1 3


246


If any of the applications returns with a nonempty result, then formula is not P-valid. A counter-example can be constructed from the returned fair subgraph. If all applications return the empty set as a result, then formula is P-valid.

Example Decomposing graph QA of Fig. 3.61 into MSCS's, we obtain the following list of subgraphs A1: f0; 2; 4; 6g; A2: f1g; A3 : f3g; A4 : f5g, A5: f7g; A6 : f 1 ; 3; 5 ; 7g. All of these subgraphs are unjust towards 1 since this transition is always enabled but not taken in any of these subgraphs. We conclude that QA contains no fair SCS and, therefore, x = 0 ) even (x) ^ odd (x) is valid over system INC2.

1

The justi cation of Algorithm GENERAL RESP follows precisely the same lines as the sequence of claims justifying its state counterpart, Algorithm STATE-RESP.

Problems Problem 3.1 (program PROD-CONS without compassion)

page 159 Consider program PROD-CONS (Fig. 3.5) under the assumption that the transitions corresponding to the request statements are taken to be just, and the compassion set is empty. Show that, in spite of this weakening assumption, the program still satis es the response property at `2 ) at `4 :

1

Problem 3.2 (invariant for program ALTER)

page 176

Prove the invariant Y [1::j 1] = X[1::j 1] for program ALTER of Fig. 3.18. In your proof you may use invariants I1 {I6 presented in the text. Please verify any of the invariants you use.

1

Problem 3.3 (communal accessibility for program INADEQUATE) page 200 Prove communal accessibility N2 > 0 ) (N3 > 0) for program INADEQUATE

(Fig. 3.37).

Problem 3.4 (using the completeness construction to verify MUX-SEM)

page 224


Problems

247

Use the construction outlined in the completeness proof of Section 3.8 to verify accessibility for program MUX-SEM of Fig. 3.1.

c Z. Manna and A. Pnueli, 28 Oct. 96. Not for Distribution

Chapter 5: Response for Parameterized Programs

91

Chapter 2

Response for Parameterized Programs In this chapter we study methods for proving response properties of parameterized programs. Parameterized programs allow the variable size (dynamic) statements M

j =1

S[j]

and

M

OR S[j]. j =1

The elaboration of such a statement is deferred until execution reaches it. At that point, the variable (or expression) M is evaluated and the program prepares to execute the statement S[1] k : : : k S[m] or S[1] or : : : or S[m], respectively, where m is the current value of M. Each parameterized statement S[i], for i = 1; : : :; m, is obtained by substituting the numeral i for the formal parameter j appearing in the text of the program and using it as a subscript in the labels and locally declared variables. Note that the variable M may be an input variable or may even be computed during the execution up to this point. In both cases, it is required that, on arrival to the dynamic statement, M has the value of a positive integer. We have already considered such parameterized programs when studying methods for verifying their safety properties (Section 2.1 of the SAFETY book). To do so, we introduced several notations: If ì is a location within the parameterized statement S[k], we write at ì [k] to denote that control is currently at location ì within statement S[k]. For a cooperation statement, we write Li for the set of processes whose control is currently at ì , i.e., Li = k 2 [1::M] j at ì [k] ; and

92



Ni = jLi j for the size of this set. These notations are extended to sets and ranges of locations. Thus, Li1 ;i2 ;:::;ik = Li1 [ Li2 [ [ Lik Li::j = Li [ Li+1 [ [ Lj Ni1 ;i2 ;:::;ik = jLi1 ;i2 ;:::;ik j Ni::j = jLi::j j: The study of methods for verifying safety properties of parameterized programs in that section led to the conclusion that, with the appropriate notations, the basic rules are applicable and no special extensions are required to deal with parameterized progrmas. We intend to establish a similar conclusion for response properties, while illustrating the utility of the special notations for proving response properties of parameterized programs. In most of the chapter, we consider the simpler case of response formulas p ) q, where p and q are assertions. The generalization necessary to handle the more general case that p and q are arbitrary past formulas is straightforward. Instead of assertions, we use past formulas, and instead of requiring that implications such as p ! q (for assertions p and q) be P-state valid, we require that the entailment p ) q, for past formulas p and q be P-valid.

1

2.1 Parameterized Well-Founded Rule In most of the cases, response proofs of parameterized programs must be based on a version of rule WELL-J (Fig. 1.26), rather than on the weaker rule CHAIN-J (Fig. 1.7). This is due to the potentially unbounded number of helpful steps, which may depend on the value of the parameter M. Rule WELL-J assumes that we can nd a xed number m of intermediate assertions '0 ; : : :; 'm , with corresponding helpful transitions 1 ; : : :; m , and ranking functions 0 ; : : :; m . To verify properties of parameterized programs, we can still use a xed number of intermediate formulas and helpful transitions but they may refer to an additional variable k which is a process index. To improve readability of formulas, we write i [k] as i [k].

Example (program TRIVIAL)

Consider the parameterized program TRIVIAL of Fig. 2.1. This program satis es the response property


2.1 Parameterized Well-Founded Rule

93

in M: integer where M > 0 M i=1

P[i] :: [`0 : skip; `1 : skip; `2 : ] Fig. 2.1. Program TRIVIAL.

N | 0{z> 0} ) p

1 | {z }

N1 > 0 , q='0

which states that, if some process is at `0 , then eventually some process will be at `1 . A natural intermediate assertion to be used for proving this property is '[k]: at `0 [k]. This assertion refers to the process index k such that P[k] is currently at `0 . The transition which is helpful for states satisfying '[k] is [k]: `0 [k]. This shows that the identity of the helpful transition may also depend on the process index parameter k. In Fig. 2.2 we present rule WELL-JP, a version of rule WELL-J, extended to accommodate parameterized intermediate formulas and corresponding parameterized helpful transitions. For each i = 1; : : :; m, the parameter k in 'i [k] and i [k] is assumed to range over some nonempty set Ri whose size may depend on the inputs to the program. For i 6= j, the ranges Ri and Rj may be dierent. For each j = 1; : : :; m, we use the notation 'bj as an abbreviation for 'bj : 9u 2 Rj : 'j [u] indicating that 'bj holds at a state if 'j [u] holds there, for some u 2 Rj . We refer to 'bj as the summary of the parameterized formula 'j [k]. As usual, it is sucient to check premise JP2 for 6= i [k].


1

We show how to prove the response formula N | 0{z> 0} ) N| 1{z> 0} p

q

94



For assertions p, and q = '0 , '1 [k]; : : :; 'm[k], transitions 1 [k]; : : :; m [k] 2 J , a well-founded domain (A; ), and ranking functions 0 ; : : :; m : 7! A JP1. p !

m _ j =0

'bj

9 > > > > > > > i i i = i = 1; : : :; m, for every 2 T > forand k 2 Ri m > _ > 0 0 ('bj [r] ^ i j ) > JP3. i k ^ 'i [k] ! > > j > ; JP4. 'i [k] ! En i [k] 3 2_ m 0 0 6 ('bj ^ i j ) 77 JP2. ^ 'i [k] ! 64j 5 0 0 _ ' [k] ^ = =0

[ ]

=0

p )

1

q

Fig. 2.2. Rule WELL-JP (parameterized well-founded response under justice).

for program TRIVIAL (Fig. 2.1), using rule WELL-JP. Take m = 1 and the following parameterized intermediate assertions, helpful transition, and ranking functions: '1 [k]: at `0 [k]; 1 [k]: `0 [k]; 1 : 1 q = '0 [k]: N1 > 0; 0 : 0; where the parameter k ranges over R: [1::M]. Note that 'b1 = 9u 2 [1::M]: at `0 [u] = N0 > 0. Let us check that all premises of rule WELL-JP are satis ed by this choice. Since m = 1 all multiple disjunctions over j collapse to a single disjunct. Premise JP1 requires N | 0{z> 0} ! _ N| 0{z> 0} ; p

which is valid.

b'1



95

For premise JP2, it suces to show 0 ^ at | {z`0[k]} ! _ _ |at {z`0[k]} ; '0 [k] ^ =0

'[k]

for every 6= `0 [k]. Clearly, any such transition preserves the truth of

at `0 [k].

Premise JP3 requires 0 `0 [k] ^ at | {z`0[k]} ! N| 1{z> 0} _ , '[k]

q0

which is obviously valid. Premise JP4 requires the obviously valid implication at | {z`0[k]} ! at| {z`0[k]} : En ( [k])

'[k]

This established the validity of N0 > 0 )

A Useful Well-Founded Domain

1

(N1 > 0) over program TRIVIAL.

Progress in parameterized programs can often be measured by the number of processes that satisfy some requirements. For example, the response property N0 > 0 ) (N0 = 0) states that, starting from a state at which some processes are at location `0 , eventually we will get to a state at which no process is executing at `0 . The most natural progress measure for such cases is the set of indices of the processes that currently satisfy the requirement of interest. For example, we can respecify eventual evacuation of location `0 by the formula L0 6= ; ) (L0 = ;), and use L0 as the ranking function. It is straightforward to show that the domain of subsets of f1; : : :; M g with the ordering relation taken as set inclusion, i.e., the domain (2[1::M ]; ) is well founded. While proving veri cation conditions involving a ranking function of the form Li , we have to establish inclusions of the form Li L0i and Li L0i . To prove Li L0i , we will establish 8j 2 [1::M]: at 0 ì [j] ! at ì [j], which guarantee that any index j belongs to L0i only if it also belongs to Li .

1

1

96



To prove Li L0i , we will establish 8j 2 [1::M]: at 0 ì [j] ! at ì [j] ^ 9j 2 [1::M]: at ì [j] ^ :at 0 ì [j]: The rst clause of this conjunction guarantees that Li L0i , while the second clause requires the identi cation of, at least, one process which has just left Li . Example (evacuation of `0 in program TRIVIAL) We prove the response formula L| 0{z6= ;} ) L| 0{z= ;} ;

1

p

q

specifying eventual evacuation of location `0 for program TRIVIAL. We take m = 1, and choose as follows: '1[k]: at `0 [k]; 1 [k]: `0 [k]; 1 : L0 '0[k]: L0 = ;; 0 : ;: Let us check that all premises of rule WELL-JP are satis ed by this choice. To establish JP1, it is sucient to show L| 0{z6= ;} ! _ 9| j 2 [1::M]: {z at `0[j]}

b'1

p

which is valid. To establish JP2, it is sucient to show 0 0 ^ at | {z`0[k]} ! at `0[k] ^ L0 L0 ;

{z

|

'1 [k]

'01 [k] ^ 1 < 10

for every 6= `0 [k]. There are two cases to be considered: = `0 [i] for i 6= k, and = `1 [i]. It is clear that none of these transitions can invalidate at `0 [k], or cause a new process to join L0 . For premise JP3, it is sucient to show 0 0 0 `0 [k] ^ at | {z`0[k]} ! (L0 L0) ^ L| 0{z= ;} ^ 9j: at `0[j] : '00

'1 [k]

}

|

{z 'b01

}

The strict inclusion L0 L00 follows from the fact that transition `0 [k] causes P[k] to move away from `0 to `1 , and does not change the location of any other process. Premise JP4, at | {z`0[k]} ! at| {z`0[k]} '1 [k]

En 1 [k]



97

is obviously valid.

Example (program MAX-ARRAY)

As a more advanced example, consider program MAX-ARRAY for parallel computation of the maximum of an integer array. This program was rst presented in Fig. 2.5 of the SAFETY book and is reproduced here in Fig. 2.3.

in M: integer where M 1 x : array [1::M] of integer local y : array [1::M] of boolean where y = T out z : integer `0 : `4 : `8 :

i;j 2[1::M ] M i=1

P[i; j] ::

"

Q[i] ::

"

`1 : if x[i] < x[j] then `2 : y[i] := F `3 :

#

#

`5 : if y[i] then `6 : z := x[i] `7 :

Fig. 2.3. Program MAX-ARRAY ( nding the maximum of an array). In Section 2.2 of the SAFETY book, dealing with safety, we proved the partial correctness of this program, expressed by at `8 ) maximal (z; x). To complete the veri cation of this program, we have to prove its termination, expressed by response property at | {z`0} ) at| {z`8} : p

1

q

Intuitively, termination is obvious, since each process has a straight line program with no loops. To prove it formally, using rule WELL-JP, we identify a well-founded domain (A; ): [1::8]; > 2[1::M ]; : Note that (r1 ; L1) (r2; L2 ) for r1 ; r2 2 f1; : : :; 8g and L1 ; L2 [1::M] if r1 > r2 or (r1 = r2) ^ (L1 L2 ). The parameterized intermediate assertions and helpful transitions, and the ranking functions are given in the table of Fig. 2.4. To compare a ranking function

98



such as 6 : (6; L2 ) with a shorter rank such as 4 : 5, we pad the shorter tuple on the right by the empty set ;. Thus, we are actually comparing (6; L2) with (5; ;). '8

: at `0

8

: `0

8 : 8

'7 [i; j]: at `1 [i; j] ^ N1::3 = M 2

7 [i; j]: `1 [i; j]

7 : (7; L1)

'6 [i; j]: at `2 [i; j] ^ N2;3 = M 2

6 [i; j]: `2 [i; j]

6 : (6; L2)

'5

: N3 = M 2

5

: `3

5 : 5

'4

: at `4

4

: `4

4 : 4

'3 [i] : at `5 [i] ^ N5::7 = M

3 [i] : `5 [i]

3 : (3; L5)

'2 [i] : at `6 [i] ^ N6;7 = M

2 [i] : `6 [i]

2 : (2; L6)

'1

1

1 : 1

: N7 = M

q = '0 : at `8

: `7

0 : 0

Fig. 2.4. Assertions, transitions and rankings for program MAX-ARRAY. Note that we refer to the exit transitions from the cooperation statements `0 and `4 by the names `3 and `7 , respectively. These are single transitions that are enabled only when all processes within the cooperation statement have reached their terminal locations `3 and `7 , respectively. The summaries of the parameterized assertions are given by 'b7: N1 > 0 ^ N1::3 = M 2 'b6: N2 > 0 ^ N2;3 = M 2 'b3: N5 > 0 ^ N5::7 = M 'b2: N6 > 0 ^ N6;7 = M: As we see, the table refers to eight parameterized assertions and helpful transitions. Assertions '6 , '7 , and their corresponding transitions are parameterized by i; j 2 [1::M], while assertions '2, '3 , and their corresponding transitions are parameterized by i 2 [1::M]. Thus, assertions '6 and '7 can be viewed as parameterized by k = hi; j i, ranging over R6 = R7: [1::M] [1::M], assertions '2 and '3 are parameterized by k = i, ranging over R2 = R3: [1::M], and assertions '1 , '4 , '5 , and '6 can be viewed as trivially parameterized by k ranging over R1 = R4 = R5 = R6: [1]. Note that, for i 2 f1; 4; 5; 6g, 'bi = 'i . The proof uses the following invariant


2.2 Representation by Diagrams

8N = 1 ^ N > :: ; :: = 0 _ < ;; : >N :: = M ^ N ; :: = 0 _ :N :: = M ^ N :: ; = 0: 048

1 3

99

1 35 7

2

04 8

5 7

0 48

It is not dicult to check the premises of rule WELL-JP and verify that they are all satis ed. For example, let us check premise JP3 for assertion '2 [i]. We show that the following implication is state valid `6 [i] ^ at `6 [i] ^ N6;7 = M ! _ |N70 = M ^ (2; {z L6) (1; 0)} _

|

{z

'2 [i]

}

'b01 ^ 2 10

N60 > 0 ^ N60 ;7 = M ^ (2; L6) (2; L06) : | {z } 'b02 ^ 220

Assertion '2 [i]: at `6 [i] ^ N6;7 = M implies N7 M 1. To show the validity of the implication, we consider two cases. If N7 = M 1, then transition `6 [i] leads to a successor state in which N7 = M, establishing '01 . If N7 < M 1, there exists another index k 6= i such that at `6 [k] holds at the state before the transition and therefore also at the successor state. This establishes 'b02 and a rank decrease at the successor state.

2.2 Representation by Diagrams To represent a proof of parameterized program by veri cation diagrams using rule WELL-JP, we follow the same conventions as for RANK diagrams (see Section 1.4), but introduce a special notation for parameterized nodes and edges. A parameterized node is identi ed by a parameterized assertion of the form 'j : k 2 Rj : f[k], where Rj is the range of the parameter k, which may be dierent for dierent j's, and f is an assertion that may refer to the parameter k. When there is no danger of ambiguity (and the range Rj is understood from the context), we may also represent the parameterized assertion as 'j [k]: f[k]. To make the treatment uniform, we view nodes labeled by an unparameterized assertion 'u as though they were labeled by the trivially parameterized assertion 'u : k 2 f1g: fu [k], where fu [k] = 'u .

100



Edges departing from a node parameterized by k are of the following forms: A double-line edge labeled by [k]. A single-line edge labeled Tr which stands for the set of by a set-expression transition instances r [i] j i 2 Rr , where Rr is the range of the parameterized transition r [i].


In Fig. 2.5, we present a P-RANK diagram for program TRIVIAL of Fig. 2.1. '1 : k 2 [1::M] : at `0 [k] T0 `0 [k]

'0 : N1 > 0

?

Fig. 2.5. P-RANK diagram for program TRIVIAL. Node '1 in this diagram is parameterized by k 2 [1::M], while node '0 is unparameterized. Assertion '0 can be trivially represented as parameterized by writing '0: k 2 f1g: N1 > 0.

Veri cation and Enabling Conditions for P-RANK Diagrams

Consider a non-terminal node labeled by the assertion '[k] and the ranking . Let L be a label of some edge departing from the node '. Let '1 ; : : :; 'n , n > 0, be the successors of ' by L-labeled edges and let 1 ; : : :; n be the ranking functions of these successors. If L = [k] (labeling double edges), then the following veri cation conditions are implied: [k] ^ '[k] ! ('b01 ^ 10 ) _ _ ('b0n ^ n0 ) '[k] ! En [k] : If L = Tr (labeling single edges), then the following veri cation condition is implied: r [i] ^ '[k] ! ('0 [k] ^ < 0) _ ('b01 ^ 10 ) _ _ ('b0n ^ n0 ) :



101

In addition, Let r be any transition not appearing in the label of any edge departing from '. Then, the following veri cation condition is implied: 'r [i] ^ '[k] ! '0 [k] ^ < 0 . This corresponds to transitions labeling n = 0 single edges.


The P-RANK diagram of Fig. 2.5 implies the following veri cation conditions: `0 [k] ^ at `0 [k] ! N10 > 0 ^ |{z} 1 > |{z} 0 at `0 [k] ! at | {z`0[k]} En `0 [k] `0 [i] ^ at `0 [k] ! at `1 [i] ^ at `0 [k] ! at

1

00

`00 [k] ^ 1 1) _ (N10 > 0 ^ 1 > 0) `00 [k] ^ 1 1. The last veri cation condition corresponds to transition `1 [i] which labels no edge departing from '1 . In Fig. 2.6, we present a P-RANK diagram for the evacuation property L0 6= ; ) (L0 = ;) for program TRIVIAL.

1

# "

! ;

;

'1 : k 2 [1::M] : at `0 [k] 1 : L0 `0 [k] `0 [k] '0 : L0 = 0 :

Fig. 2.6. P-RANK diagram for eventual evacuation of `0 . Note that while P[k] is at `0 , no other transition `0 [i], for i 6= k, can cause L0 to become empty. This is why we do not need a single edge labeled by T0 connecting node '1 to node '0 .

Valid P-RANK Diagrams

102



A P-RANK diagram is said to be valid over program P (P-valid for short) if all the veri cation conditions associated with the diagram are P-state valid. The consequences of having a valid P-RANK diagram are stated in the following claim:

Claim 2.1 (P-RANK diagrams)

A P-valid P-RANK diagram establishes that the response formula m _

j =0

1b

)

'0

is P-valid. If, in addition, we can establish the P-state validity of the implications p !

m _

j =0

'bj

and

'b0 ! q

1

then, we can conclude the P-validity of p ) q.

Justi cation The rst part of the claim follows from the soundness rule WELL-JP, and the observation that the veri cation conditions induced by a P-RANK diagram imply premises JP2{JP4 of rule WELL-JP. Given the two additional implications, we can also infer premise JP1 and the replacement of 'b0 by q. Example (program MAX-ARRAY)

We return to the example of program MAX-ARRAY (Fig. 2.3), for which we wish to prove termination, speci ed by at | {z`0} ) at| {z`8} : p

1

q In Fig. 2.7 we present a P-RANK diagram for this property.

In this diagram, we use encapsulation conventions to factor out the pre x i;j 2 [1::M] from '6 and '7 and write it as a label of the supernode containing these nodes. A similar factoring was applied to nodes '2 and '3 . When we compute the default veri cation conditions corresponding to transitions that do not label departing edges, it is important to consider these transitions only for the values of the parameter which do not appear in labels of departing edges. Consider, for example, the veri cation conditions for the parameterized assertion '6 : i; j 2 [1::M]: at `2 [i; j] _ N2;3 = M 2 . The veri cation condition corresponding to the double edge departing from '6 is:

F # " # " E F # " # " E



'8 : at `0 `0

i; j 2 [1::M]: `1 [i; j] '7 : at `1 [i; j] ^ N1::3 = M 2 7 : (7; L1 ) `1 [i; j] `1 [i; j]

C

! ^ ! D C ^ ! ^ ! D

'6: at `2 [i; j] N2;3 = M 2 6 : (6; L2 ) `2 [i; j] `2 [i; j] '5 : N3 = M 2 `3

i 2 [1::M]: `5 [i]

'4 : at `4 `4

'3: at `5 [i] N5::7 = M 3 : (3; L5 ) `5 [i]

`5 [i]

'2 : at `6 [i] N6;7 = M 2 : (2; L6 ) `6 [i]

`6 [i]

'1 : N7 = M `7 '0 : at `8

Fig. 2.7. P-RANK diagram by rule WELL-JH for program MAX-ARRAY.

103

104



`2 [i; j] ^ at `2 [i; j] ^ N2;3 = M 2 ! | {z } '6

at 0 `2 [i; j] ^ N20 ;3 = M 2 ^ (6; L2) (6; L02 ) _ N30 = M 2 ^ (6; L2) 5 : Among the default veri cation conditions, we should include (k; r) 6= (i; j) ^ `2 [k; r] ^ at `2 [i; j] ^ N2;3 = M 2 ! at 0 `2 [i; j] ^ N20 ;3 = M 2 ^ (6; L2) (6; L02), as asll we

`1 [k; r] ^ at `2 [i; j] ^ N2;3 = M 2 ! at 0 `2 [i; j] ^ N20 ;3 = M 2 ^ (6; L2) (6; L02).

Note the dierence between the condition corresponding to `2 [k; r] and the one corresponding to `1 [k; r]. In the case of `2 , we have to exclude the parameter value (k; r) = (i; j), since `2 [i; j] already labels an existing edge departing from '[i; j]. To do so, we add the conjunct (k; r) 6= (i; j) to the antecedent of the implication. In the case of `1 , which labels no edge departing from '7 [i; j], no such restriction is necessary.

Example (mutual exclusion by turn setting)

Consider parameterized program TURN of Fig. 2.8 which manages mutual exclusion between an arbitrary number of processes by turn setting. The program uses a shared variable t, which is initially 0. Each process P[i], interested in entering its critical section, loops in `2::5 trying to change t to the identity number of P[i], namely i. The grouped statement at `3 is such that it sets t to i only if it nds t = 0. If P[i] nds t 6= 0 it does not modify t but still moves to `4 . At `4 the process checks whether its execution of `3 succeeded in setting t to i. Finding a value t = i at `4 , P[i] enters its critical section `5 . Otherwise it returns to `2 and then to `3 to try again. Mutual exclusion is ensured by the invariant : i 2 L5;6 ! t = i. We wish to show a weak-accessibility property, formulated by N : |N2 > 0{z^ t = 0} ) | 5{z> 0} : p

1

q

This formula states that if some process is at `2 with t = 0, then eventually some process will get to `5 . We refer to it as weak accessibility (sometimes also as communal accessibility ), since it does not guarantee that the same process detected at `2 with t = 0 will be the one to enter `5 . The stronger property



105

in M: integer where M > 1 local t : integer where t = 0

2` : loop forever do 3 377 66 2` : noncritical 66 6` : while t 6= i do 77777 66 66 2

M 37 P[i] :: 66 66 ` : if t = 0 then t := i 77777 75777 i 66 66 64` : if t = i then 75775 64 64 ` : critical 0

1

2

3

=1

4

`6 : t := 0

5

Fig. 2.8. Program TURN (mutual exclusion by turn setting).

of accessibility, claiming that any individual process visiting `2 with t = 0, will eventually reach `5 , which can be expressed by the formula at `2 [i] ^ t = 0 ) at `5 [i], is not valid for this program. In Problem 2.1, the reader is requested to show that accessibility is not guaranteed for program TURN. To verify the weak-accessibility property expressed by , we use the following in rule WELL-JP '3[k]: at `2 [k] ^ N3 = 0 ^ t = 0 3 : 3 3 [k]: `2 [k] '2[k]: at `3 [k] ^ t = 0 2 : 2 2 [k]: `3 [k] '1 : at `4 [t] ^ t 6= 0 1 : 1 1 : `4 [t] q = '0 : N5 > 0 0 : 0:

1

We proceed to check the premises of rule WELL-JP. Premise JP1 requires showing p ! _ 'b3 . Since N2 > 0 implies the assertion 'b3: 9k: at `2 [k], the premise follows. Premise JP2 will be checked for each i = 1; 2; 3. '3 [k]: at `2 [k] ^ N3 = 0 ^ t = 0 Most of the transitions satisfy JP2 for '3 by preserving '3 and 3 . The only transitions that may falsify '3 are transitions of the form `2 [i]. Transition `2 [i] leads to a state satisfying 'b2 : 9r: at `2 [r] ^ t = 0. '2 [k]: at `3 [k] ^ t = 0

106



The only transitions that can falsify '2 are of the form `3 [i]. However, such a transition leads to a state satisfying '1 : at `4 [t] ^ t 6= 0. '1 : at `4 [t] ^ t 6= 0 The only transition that can falsify '1 is `4 [t] which leads to a state satisfying the goal assertion q: N5 > 0. Premise JP3 will be checked for each i = 1; 2; 3. '3 [k]: at `2 [k] ^ N3 = 0 ^ t = 0 Here we show `2 [k] ^ | ^{zt = 0} ! 9r: at 0 `3 [r] ^ t0 = 0 ^ 3 > 2.

|

'3

{z 'b02

}

Since `2 [k] implies at 0 `3 [k] and t0 = t, the implication is valid. '2 [k]: at `3 [k] ^ t = 0 Here we show `3 [k] ^ |N3 > 0{z^ t = 0} ! at 0 `4 [t] ^ t0 6= 0 ^ 2 > 1. '2

|

{z 'b01

}

Since `3 [k] under t = 0 implies at 0 `4 [k] and t0 = k 6= 0, the right-hand side follows. '1 : at `4 [t] ^ t 6= 0 We will show 0 `4 [t] ^ |at `4 [t]{z^ t 6= 0} ! N | 5{z> 0} : '1

q0

Since `4 [t] and t 6= 0 imply at 0 `5 [i], the right-hand side follows. Premise JP4 is obviously satis ed, since 'i [k] implies En i [k] for i = 1; 2; 3. We can summarize this WELL-JP proof in the P-RANK diagram presented in Fig. 2.9.

Program RACE Consider program RACE, presented in Fig. 2.10. This program consists of M competing processes. The rst process P[k1] to perform statement `1 will set its local variable t[k1] to 1, while incrementing the shared variable y to 2. This process eventually gets back to location `0 and, on nding t[k1] = 1 will proceed to `2 . All processes performing statement `1 later than P[k1] will obtain values of t[k] greater than 1, and cannot exit the while loop at `0 .



F

k 2 [1::M]: t = 0

? D 6

'3 : at `2 [k] ^ N3 = 0 T2 `2 [k]

E

C

'2 : at `3 [k] `3 [k] T3

'1: at `4 [t] ^ t 6= 0 `4 [t]

107

'0 : N5 > 0

Fig. 2.9. P-RANK diagram for program TURN.

in M: integer where M > 0 local y : integer where y = 1

M k=1

2local t: integer where t = 03 77 6` : while t 6= 1 do P[k] :: 664 7 ` : (t; y) := (y; y + 1) 5 0

1

`2 :

Fig. 2.10. Program RACE.

The property we wish to establish for this program is that eventually some process reaches `2 . This property is stated by the following response formula. N | 0 > 0 {z^ y = 1} ) |N2{z> 0} : p

1

q

It is easy to trace the progress of the computation towards the goal N2 > 0 through the stages 'b3: N0 > 0 ^ y = 1 (initial) and 'b2: N1 > 0 ^ y = 1,

108



up to

'1[k]: at `0 [k] ^ t[k] = 1. The next helpful step takes transition `0 [k] and reaches q = '0 : N2 > 0. Consequently, we choose assertions, helpful transitions, and ranking functions as follows: '3 [k]: at `0 [k] ^ y = 1 3 [k]: `0 [k] 2 : 3 '2 [k]: at `1 [k] ^ y = 1 2 [k]: `1 [k] 2 : 2 '1 [k]: at `0 [k] ^ t[k] = 1 1 [k]: `0 [k] 1 : 1 '0 : N0 > 0: In Fig. 2.11, we present a P-RANK diagram representing this proof.

F F

k 2 [1::M]: y=1

E E

'3 : at `0 [k] `0 [k]

'2 : at `1 [k] `1 [k]

^

C C

D D

'1 : at `0 [k] t[k] = 1 `0 [k]

'0 : N2 > 0

Fig. 2.11. P-RANK diagram for program RACE.

Advanced Example: Resource-Allocator Program



109

In some cases, response properties of a parameterized program can be proven without the need for explicit parameterization of the assertions and helpful transitions. Thus, rules CHAIN-J (Fig. 1.7) and WELL-J (Fig. 1.26) can be used directly. We illustrate this on the example of a resource allocator program. We reconsider program RES-SV for the allocation of a resource between several customers (the shared-variables version). This program was rst presented in Section 2.2 of the SAFETY book (Fig. 2.9), and is reproduced here in Fig. 2.12. We denote t M 1 = (t mod M) + 1.

in M : integer where M > 0 local g; r: array [1::M] of boolean where g = F; r = F

2local t: integer where t = 1 3 7 66m : loop forever do 3777 66 2m : if r[t] then 6 377 2 A :: 666 666 m : g[t] := T 77777 66 66 64m : await :r[t]757777 64 64 m : g[t] := F 7575 0

1

2

3

4

m5 : t := t M 1

3 2 ` : loop forever do 66 2` : noncritical377 7 66 6 66 66` : r[i] := T 777777 C[i] :: 66 66` : await g[i] 7777 66 66` : critical 7777 64 64` : r[i] := F 7575 0

1

M i=1

2 3

4

5

`6 : await :g[i]

Fig. 2.12. Program RES-SV (resource allocator). We are interested in proving the response properties of this program. The main response property is that of accessibility, stated by the formula : at `2 [k] ) at `4 [k].

1

110



This formula states that any process that is interested in entering its critical section, will eventually succeed in doing so. We are aided in this proof by the invariant '[i]: idle [i] _ requesting [i] _ granted [i] _ releasing [i] holding for every i = 1; : : :; M, where idle [i]: at m0;1;5 _ t 6= i ^ at `0::2;6[i] ^ :r[i] ^ :g[i] requesting [i]: at m0::2;5 _ t 6= i ^ at `3 [i] ^ r[i] ^ :g[i] granted [i]: at m3 ^ t = i ^ at `3::5[i] ^ r[i] ^ g[i] releasing [i]: at m3;4 ^ t = i ^ at `6 [i] ^ :r[i] ^ g[i]: In Fig. 2.13, we present a diagram (duplicated from Fig. 2.10 of the SAFETY book) which represents the possible movements of the system between the four cases comprising assertion '[i].

' &6 ' &

idle [i]: :r[i] ^ :g[i] ^ (at m0;1;5 _ t 6= i) ^ at `0::2;6[i]

m4 releasing [i]: :r[i] ^ g[i] ^ (at m3;4 ^ t = i) ^ at `6 [i]

$' %& $' %&

requesting [i]: r[i] ^ :g[i] ^ (at m0::2;5 _ t 6= i) ^ at `3 [i]

`2 [i]

m2

?

`5 [i] granted [i]: r[i] ^ g[i] ^ (at m3 ^ t = i) ^ at `3::5[i]

Fig. 2.13. Four phases in the life of a customer process.

$ % $ %

The proof is established by the following lemmas:

1

Lemma A

at `2 [k] )

Lemma B Lemma C

at `3 [k] ^ t 6= k )

at `3 [k] ^ (at m0::3 ^ t = k) _ t 6= k

1

at `3 [k] ^ at m0::3 ^ t = k

at `3 [k] ^ at m0::3 ^ t = k )

1

at `4 [k].



111

Lemma A traces the progress of C[k] from `2 [k] to `3 [k]. Deriving at `3 [k], we distinguish between two cases according to whether the allocator is currently paying attention to C[k] (t = k) or to some other customer C[i], t = i 6= k. If the allocator is currently devoted to C[i], i 6= k, then Lemma B ensures that C[k]'s turn will eventually come. Lemma C shows that, once the allocator pays attention to C[k], process C[k] eventually advances to `4 [k]. Clearly, by the transitivity of response (rule TRNS-R), we obtain the required accessibility property.

Proof of Lemma A

1

The proof of the response property at `2 [k] ) at `3 [k] ^ (at m0::3 ^ t = k) _ t 6= k using rule CHAIN-J, is presented in the diagram of Fig. 2.14.

at `2 [k]

F

at `3 [k]

`2 [k]

at m5 ^ t = k ^ :g[k]

E

at m0::3

m5

C

_ 6 ^ D t=k

t=k

Fig. 2.14. Lemma A for program RES-SV. The proof of this diagram relies on the invariant '[k], by which 3 2 at m0::3 ^ t = k _ 7 6 at `3 [k] ! 64 at m5 ^ t = k ^ :g[k] _75 t 6= k : To see this observe that, by '[k], at `3 [k] implies that either requesting [k] or granted [k] hold. The assertion requesting [k] implies

112



(at m0::2;5 _ t 6= k) ^ :g[k], which is equivalent to (at m0::2;5 ^ t = k) _ t 6= k ^ :g[k]. This implies (at m0::2 ^ t = k) _ at m5 ^ t = k ^ :g[k] _ t 6= k. Taking the disjunction of this formula with at m3 ^ t = k, which is implied by granted [k], we obtain the right-hand side of the implication above.

Proof of Lemma B

1

The proof of the response property at `3 [k] ^ t 6= k ) at `3 [k] ^ at m0::3 ^ t = k ; using rule WELL-J, is presented in Fig. 2.15. Let us trace progress towards the goal '0 in this veri cation diagram, starting from a state in which C[k] is at `3 and t 6= k. The diagram analyze the various locations in which A can currently be. If A is at m0 ('9 ) it eventually moves to m1 ('8 ). At m1 , A tests the value of r[t]. If r[t] = T, A moves to m2 ('7 ). Otherwise, A moves to m5 ('1 ). According to invariant '[t] (i.e., '[i] when i = t), when A is at m2 , g[t] = F and since, on entering m2 , A has just tested r[t] to be T, we obtain the conjunction at m2 ^ r[t] ^ :g[t] in '7 . By '[t], r[t] ^ :g[t] implies at `3 [t] which complete '7 . From m2 , A eventually sets g[t] to T and moves to m3 . At this point, we analyze the various possible locations of C[t], i.e., the customer process C[i], i = 1; : : :; M, such that currently t = i. Since at '7 , C[t] is at at `3 [t] and r[t] = T, transition m2 leads to the state described by '6 . From `3 , C[t] moves to `4 ('5 ) and from there to `5 ('4 ). Taking `5 , r[t] is reset to F and C[t] moves to `6 ('3 ) waiting for g[t] to become F. Up until this point, A cannot move because it waits for r[t] to become F. Once r[t] = F, A moves to m4 ('2 ) and from there to m5 ('1 ). At m5 , A sets t to t M 1 advancing to the next process index in cyclic order. There are two cases. If t = (k 1) mod M then t M 1 = k and transition m5 leads to a state in which A is at m0 , t = k, and C[k] is still waiting at `3 . If t 6= (k 1) mod M then m5 leads again to a state covered by '9. Here we must show that this transition causes a rank decrease. This means that (t; k); 1 > (t M 1; k); 9 ; for t 6= k. To show this, we will prove (t; k) > (t M 1; k) for t 6= k. Recall that the cyclic distance function was de ned in Section 3.4 of the SAFETY book as



F

113

C

F C

E D

at `3 [k]; t 6= k; :g[k] (t; k): (k t) mod M

mF1 ' : at m 8 1

m0 ' : at m 9 0

mT1

'7 : at m2 ^ at `3 [t] ^ r[t] ^ :g[t] m2 at m3 ; g[t] r[t]

'6 : at `3 [t] `3 [t] '5 : at `4 [t] `4 [t] '4 : at `5 [t] `5 [t]

'3 : at `6 [t] ^ :r[t] m3

'1 : at m5 m4 '2 : at m4 m5 m5

E

^

D

'0: at `3 [k] at m0::3 ^ t = k

Fig. 2.15. Lemma B for program RES-SV.

(t; k): (k t) mod M. This function measures the number of times t has to be increased by 1 modulo M until it equals k. It is obvious that if t 6= k then t M 1 is closer to k in a cyclic distance than t. For example, consider a situation where M = 8, t = 8 and k = 3.

114



Observe that t 8 1 = 8 8 1 = (8 mod 8) + 1 = 1. The two cyclic distances are (t; k) = (8; 3) = (3 8) mod 8 = ( 5) mod 8 = 3 (t 8 1; k) = (1; 3) = (3 1) mod 8 = 2 mod 8 = 2. Note that the restriction to t 6= k is essential, because if t = k then (t; k) = (k; k) = 0 6> (t M 1; k) = (k M 1; k) = ( 1) mod M = M 1. Let us prove the rank decrease for arbitrary M > 1 and arbitrary t 6= k, using the mathematical de nitions of M and (t; k). Let n denote (t; k) = (k t) mod M . Obviously 0 n < M. From the facts that 0 < t M, 0 < k M, and t 6= k, it follows that n 6= 0. Using 0 < n M, we compute (t M 1; k) = k (t M 1) mod M = k (t mod M) + 1 mod M = (k 1) (t mod M) mod M = (k 1 t) mod M = 1 + (k t) mod M = 1 + ((k t) mod M)) mod M = ( 1 + n) mod M = (n 1) mod M = n 1 < n = (t; k): This computation uses the fact that, for C satisfying 0 C < M, C mod M = C, and the following property of the mod operator: a (b mod M) = (a b) mod M, which allows the introduction and elimination of mod M within the scope of another mod M.

Proof of Lemma C

1

The response property at `3 [k] ^ at m0::3 ^ t = k ) at `4 [k], is proven by rule CHAIN-J. The proof is presented in the diagram of Fig. 2.16.

The Bakery Algorithm



F :F E E

C

at `3 [k]; r[k]; t = k

g[k]

115

C

D ^

D

at m0 m0

at m1 m1

at m2

m2

at m3

g[k] `3 [k]

at `4 [k]

Fig. 2.16. Lemma C for program RES-SV.

In Fig. 2.17, we present an atomic version of the bakery algorithm for mutual exclusion among M > 0 processes. The algorithm is called the bakery algorithm, since it is based on the idea that customers, as they enter, pick numbers which form an ascending sequence. Then, a customer with a lower number has higher priority in accessing its critical section. Statement `2 ensures that the number assigned to y[i] is greater than the current value of ticket [j], for all j = 1; : : :; M. Then statement `3 admits process P[i] into the critical section only if, for all j 6= i, either y[j] = 0, implying that process P[j] is currently not interested in entering its cricial section, or ticket [j] > ticket [i] which implise that P[j] has a higher turn number and, therefore, a lower priority than P[i]. We refer to this version of the program as atomic because it assumes that taking the maximum of ticket [1]; : : :; ticket [M] can be done in one step and, similarly, testing that all P[j] for j 6= i have lower priority than P[i] can be done in one step.

Proving Mutual Exclusion

To prove the property of mutual exclusion, we rst establish some local invariants, relating the value of ticket [i] to the location of process P[i]. 0: ticket [i] 0 1: ticket [i] > 0 $ at `3::5[i]. Consider two distinct processes, P[i] and P[k], for i 6= k. Their mutual exclusion can be speci ed by the invariance of the assertion : : at `4 [i] ^ at `4 [k] :

116



in M : integer where M > 0 local ticket : array[1::M] of integer where ticket = 0

3 2` : loop forever do 377 66 2` : noncritical 66 6 77777 [i] := 1 + max(ticket [1]; : : :; ticket [M]) P[i] :: 66 66`` :: ticket 66 66 await 8j 6= i: ticket [j] = 0 _ ticket [i] < ticket [j]777777 55 4 4` : critical 0

M i=1

1

2

3

4

`5 : ticket [i] := 0

Fig. 2.17. Program BAKERY-AT (atomic bakery algorithm).

Applying the technique of assertion propagation (described in Chapter 1 of the SAFETY book), we obtain the following necessary condition for being invariant (taking into account invariant 0 ): : at `3 [i] ^ at `4 [k] ! 9j 6= i: 0 < ticket [j] ticket [i]. A good heuristic is to try to establish mutual exclusion of P[i] and P[k], using assertions that only refer to the variables of P[i] and P[k]. Therefore we may look for the weakest (i; k)-assertion which implies . This is given by at `3 [i] ^ at `4 [k] ! 0 < ticket [k] ticket [i]. Since at `4 [k] implies ticket [k] > 0 by 1 , we can simplify the candidate assertion to 3: at `3 [i] ^ at `4 [k] ! ticket [k] ticket [i]. It is not dicult to ascertain that 3 is an invariant (using 0 and 1 ). Informally, we may consider the two relevant transitions. Taking `3 [k] while at `3 [i]. Transitions `3 [k] can be taken only if ticket [i] = 0 or ticket [k] < ticket [i]. By 1, at `3 [i] implies ticket [i] > 0. Therefore, taking the transition implies ticket [k] < ticket [i] which guarantees ticket [k] ticket [i]. Taking `2 [i]. This transitions sets ticket [i] to a value which is not smaller than 1 + ticket [k]. Hence ticket [k] ticket [i]. In a symmetric way, we propose and verify the invariance of 4: at `3 [k] ^ at `4 [i] ! ticket [i] ticket [k]. It is now straightforward to verify the invariance , relying on 3 and 4 as



117

previously established invariances.

Proving Accessibility

1 1

The property of accessibility for process P[i] can be speci ed by the formula : at `2 [i] ) at `4 [i]. It is trivial to follow the progress of P[i] from `2 to `3 . Consequently, the main veri cation task should establish the property : at `3 [i] ) at `4 [i]. The only reason process P[i] may be held at `3 , not being able to proceed immediately to `4 is that there are some processes superior to P[i]. A process P[j] is said to be superior to P[i] if 0 < ticket [j] < ticket [i]. Consequently, we de ne superior (i) = j 2 [1::M] j 0 < ticket [j] < ticket [i] to be the set of all (indices of) processes superior to P[i]. Consider what may happen to the set superior (i) while P[i] is waiting at `3 . Processes may leave the set superior (i) by performing `5 , setting their ticket variable to 0. Once a process has left superior (i) it cannot reenter this set because the only way for a process to attain a positive ticket value is by performing `2 . However, execution of `2 by P[j] while P[i] is at `3 , necessary leads to a value ticket [j] > ticket [i], which shows that P[j] is not in superior (i) even after execution of `2 . We conclude that while P[i] is waiting at `3 , the set superior (i) can never increase. We will now argue that if the set is non-empty, it will eventually decrease. Consider process P[j] which has the minimal positive value of ticket [j]. If superior (i) 6= ; then, obviously j 2 superior (i). Having a positive ticket value implies that P[j] is somewhere in the range f`3 ; `4 ; `5g. We claim that wherever it is, its progress is guaranteed. In particular, even if P[j] is at `3 it cannot be blocked by any other process, since ticket [j] is (positively) minimal. Thus, P[j] is guaranteed to progress until it reaches `5 , whose execution decreases the size of superior (i). Consequently, while P[i] is waiting at `3 , the set superior (i) repeatedly decreases, until it becomes empty. Once superior (i) is empty, P[i] has the minimal positive ticket and its progress to `4 is guaranteed. In Fig. 2.18, we present a P-RANK diagram for the proof of property based on the above arguments. The proof uses the assertion minimal (k): ticket (k) > 0 ^ 8j: ticket (j) > 0 ! ticket (k) ticket (j). In Problem 2.3, the reader is requested to consider several non-atomic versions of the bakery algorithm and verify their properties.

118



F

k 2 [1::M]: minimal ; at `3 [i]; superior (i) 6= ; : superior (i) '4 : at `3 [k]

C

`3 [k]

'3 : at `4 [k] `4 [k]

E

'2 : at `5 [k] `5 [k] `5 [k]

'1: at `3 [i] ^ superior (i) = ; `3 [i]

D

'0 : at `4 [i]

Fig. 2.18. A P-RANK diagram proving accessibility for program BAKERY-AT.

2.3 Coordination by Add-And-Store As our next set of examples, illustrating the techniques for proving response properties of parameterized programs, we present a family of algorithms, based on a special synchronization instruction. Some computers have special \add-and-store" instructions that fetch a value from a location in memory, add to it a number and store the result in the same location, all within one execution cycle. If several processors that have this instruction are connected to a common shared memory then, while one of them performs such an add-and-store instruction, no other processor can interfere with the value being fetched and stored at this location. This provides a natural implementation of the atomic instruction y := y + e for a shared variable y and a local expression e. A local expression is an expression that depends only on variables local to the process. Usually, the value which is stored is also retained in an internal register. This enables a single transition implementation of the multiple assignment statement (t; y) := (y + e; y + e),


2.3 Coordination by Add-And-Store

119

where y is a shared variable, e is a local expression, and t is a variable local to the process that is executing this instruction. To emphasize the special role of this statement, it is written in the form t := y := y + e, in all the programs in this section. Add-and-store statements of the described form have often been suggested as means for implementing semaphores. As we will see below, they are not as strong as semaphores, since they lack the compassion property associated with semaphores. That is, the transitions associated with add-and-store statements are not compassionate while semaphore transitions are. We present two programs that coordinate entry to critical sections by means of add-and-store statements and investigate their response properties. Since these statements are not compassionate, they cannot directly ensure individual accessibility of each process to its critical section. Instead, they can only ensure the weaker property of cummunal accessibility by which, if some process wishes to enter the critical section, some process (not necessarily the same) will eventually enter its critical section. However, as will be shown, communal accessibility can be used to program more involved algorithms that ensure individual accessibility.

Notations and Inferences To facilitate proofs of the programs in this section, we introduce some special notations that rely on the special structure of the considered programs. All programs considered here consist of a parallel composition of M processes P[1]; : : :; P[M], where M is an input to the program. Each process has a local variable t. Let à and `b , a b be two locations in the program. We de ne the following notations: Ltc a::b: i 2 [1::M] j at à::b [i] ^ t[i] c ;

tc tc Na::b : La::b where is one of the six binary relations fg. Thus, Lt>c 3::4 denotes the set of all process indices i 2 [1::M], such that P[i] is currently at `3 or at `4 and t[i] > 0, and Lt>c 3::4 denotes the total number of such processes. tc tc Ltc For the case that b = a, we write Ltc a and N a . a::b simply as tc a::b and Ntc tc tc For the case that b = a + 1, we write La::b and Na::b simply as La;b and Na;b . Theretcis an obvious connection between assertions referring to expressions such as Na::b and assertions that use existential quanti cation over the index i. For example, the following equivalence is a direct consequence of the de nitions.

120



t>0 > 0 $ 9i: at à::b [i] ^ t[i] > 0 : Na::b All quanti ed variables in this section are rigid variables denoting process indices which range over [1::M]. We therefore omit their range speci cations from the formulas. Some of the following proofs use rule EE-INTR, which can be derived in the proof system presented in Volume I.

1 ) 1 9

Rule EE-INTR (introduction of existential quanti ers) p ) q (9i: p)

1

1

( i: q)

In the case that formula q has no free occurrences of i, we can use this rule to infer (9i: p) ) q from p ) q.

Mutual Exclusion by Add-and-Store We consider rst program MUX-AST presented in Fig. 2.19, which implements mutual exclusion by add-and-store instructions.

in M: integer where M > 0 local y : integer where y = 1

3 2local t: integer 7 66` : loop forever do 3777 66 2` : noncritical 66 6 77777 66 66` : t := 1 7777 t < 0 do 66 66` : while P[i] :: 6 6 2` : await y > 0 37777 7777 66 66 6 7 6 ` : t := y := y 1 66 6 66 777777 6 66 6 66` : if t = 0 then 777777 64 64 4 ` : critical 57575 0

1

M i=1

2

3

4

5

6

7

`8 : y := y + 1

Fig. 2.19. Program MUX-AST (mutual exclusion by add-and-store).



121

The program consists of M > 0 processes which coordinate their entry to their critical sections via the shared \semaphore" variable y. In addition, each process P[i] has a local variable t which is used in the program. The program for each process is a cycle, in which the process alternates between the execution of its noncritical section at `1 and the attempt to enter its critical section at `7 . The process may elect to stay forever in its noncritical section. If the process exits its noncritical section, the protocol for trying to enter the critical section starts at `2 , where the variable t is set to 1. Then, the process enters a loop at `3 which is terminated only when t becomes nonnegative. A nonnegative value of t (actually 0), signals that the process managed to enter its critical section, and may therefore return to `1 . Within the loop, the process waits rst at `4 for y to become positive. When the process detects a positive y it performs an add-and-store statement at `5 with y and the constant 1, retaining the value stored in y also in t. One may wonder why do we need further checks after having detected a positive y at `4 . The answer is that two processes P[i] and P[j] may detect a positive y at `4 and move, one after the other, to `5 . Assume P[i] to be the rst to perform `5 . It will lower y to 0 and obtain a t[i] = 0. The second process P[j], performing `5 one step later, will get to y = t[j] = 1. Therefore, it is necessary for a process to check its own t after the addition to see whether it was the rst to perform `5 . Indeed, at `6 process P[i] checks whether it was the lucky one. On nding t[i] = 0, P[i] concludes that it was the rst to perform `5 and proceeds to enter the critical section at `7 . On exit it increments y, osetting the subtraction at `5 . Since t[i] = 0 in this case, the loop of `3 terminates, and lucky process P[i] returns to `1 . If the process nds a negative t, it concludes that it is not its turn to enter, and proceeds to `8 . Here it increments y to oset the subtraction at `5 . Since t < 0, the loop of `3 does not terminate, and the process returns to `4 to try its luck once more.

Proving Safety Properties: Mutual Exclusion

As a rst step in the veri cation of program MUX-AST, let us prove the safety property of mutual exclusion. This property states that at most one process may be at `7 , and is expressible by: N7 1. We prove several invariants that lead to the desired conclusion. The rst invariant is given by I1 : at `7 [i] ! t[i] = 0.

122



Observe that the assertions refer to the instance of variable t that belongs to process P[i] as t[i]. This invariant can be veri ed by checking the relevant transitions. They are `6 [i] which proceeds to `7 only if t[i] = 0, and `2 [i], `5 [i] which modify t[i], but do not end up at `7 [i]. A second invariant is given by I2 : N6::8 + y = 1. This is easily veri able by observing that initially N6::8 = 0 and y = 1. Then we check the relevant transitions and nd that `5 [i] decrements y by 1 but increments N6::8 by 1. The latter is because process P[i] has just joined the set L6::8 by entering `6 . Similarly, transition `8 increments y by 1 but decrements N6::8 by 1. Thus, both preserve the sum N6::8 + y. From this invariant it follows that y 1 is also invariant. The last invariant we consider is: I3 : i 6= j ! : at `6::8[i] ^ t[i] = 0 ^ at `6::8[j] ^ t[j] = 0 which states that at most one process P[i] can be at `6::8 with a zero t variable. The only transition which may potentially falsify this assertion is taking `5 [i] from a state satisfying at `6::8[j] ^ t[j] = 0 (symmetrically, taking `5 [j] from a state satisfying at `6::8[i] ^ t[i] = 0). However, in this case N6::8 > 0 which, in view of I2 , implies y 0. Since transition `5 [i] leads to t0 [i] = y 1, it follows that t0 [i] < 0. Therefore, i does not satisfy at 0 `6::8[i] ^ t0[i] = 0 and the assertion I3 is not falsi ed. This shows that all transitions preserve assertion I3 . From I1 and I3 we conclude N7 1.

Proving Response Property: Communal Accessibility

As we have already commented, the add-and-store instructions are not strong enough to guarantee individual accessibility, i.e., that each process wishing to enter its critical section will eventually do so. Instead, we prove the weaker property of communal accessibility (also called weak accessibility ). This property claims that, if some process wishes to enter its critical section, then some process (not necessarily the same) will eventually enter its critical section. This can be expressed by: N2 > 0 ) (N7 > 0). Let us prove this property. Consider the progress of a process from `2 to `7 . It can certainly advance unhindered until it reaches `4 . At `4 it has to wait until y becomes positive. Due

1



123

to I2 , y becomes positive only when the range `6::8 is evacuated by all processes currently residing there. When y becomes positive, one or more processes will reach `5 . The rst process to execute `5 , while y is positive, will get a zero value of t and will eventually get to `7 . Thus, we can partition the description of progress into phases, identi ed as follows: 1. Some process gets to `4 . 2. While some processes are at `4 and y 0, the range `6::8 is evacuated until y becomes 1. 3. Some process executes `5 while y is still 1, gets a zero t, and proceeds to `7 . Consequently, we prove these stages in the progress towards entry to the critical section as separate lemmas.

Lemma A

N2 > 0 )

1

1

(N4 > 0)

In Fig. 2.20 we present a CHAIN-J proof of the response formula at `2 [i] ) (N4 > 0).

'2 : at `2 [i] `2 [i]

'1 : at `3 [i] ^ t[i] < 0 `3 [i]

'0 : N4 > 0

Fig. 2.20. CHAIN diagram for Lemma A. Applying rule EE-INTR and observing that N4 > 0 does not refer to the index i, we obtain (9i: at `2 [i]) ) (N4 > 0), from which, by monotonicity, we conclude N2 > 0 ) (N4 > 0).

1

1

Once we know that some process is at `4 , there are two cases to consider, depending on whether y is positive. Consider rst the more dicult one, in which y 0. The following lemma claims that from the more dicult case, we are guaranteed to reach the easier case in which N4 > 0 ^ y > 0.

Lemma B

N4 > 0 ^ y 0 )

1

(N4 > 0 ^ y > 0)

124



We prove this lemma by rule WELL-JP. The proof is presented by the P-RANK diagram of Fig. 2.21.

FF

N4 > 0 k 2 [1::M]: y 0; N5::8 > 0 : L5::8 '4 : at `5 [k] `5 [k] '3 : at `6 [k] `6 [k] `6 [k]

C C

E D

E

'2 : at `7 [k] `7 [k]

'1 : at `8 [k] `8 [k] `8 [k]

'0 : y > 0

D

Fig. 2.21. P-RANK diagram for Lemma B. Note that any transition that causes N6::8 to become 0 leads, according to I2 , to a positive y. The reason we use the ranking N5::8 instead of N6::8 which is mentioned in I2 , is that N6::8 can increase by execution of `5 . The rank N5::8 cannot increase, while y 0, because no process can pass `4 if y 0.

Lemma C

N4 > 0 ^ y > 0 )

1

(N7 > 0)

This lemma is proven again by rule WELL-JP, tracing the progress from `4 to `7 . The proof is presented in the P-RANK diagram of Fig. 2.22. We use the invariant I2 to infer y > 0 ! y = 1. The three lemmas can be combined into a single P-RANK diagram, presented in Fig. 2.23. It is possible to omit most of the internal details of this diagram, and retain just the top-level structure, identifying the lemmas which lead from one phase to the next. This leads to the diagram of Fig. 2.24. This schematic diagram identi es the partition of the proof into three lemmas. Each lemma is represented as a box, with exits that lead to subsequent



FF E E

C

C

D 6

k 2 [1::M]: y=1 '3 : at `4 [k] `4 [k]

'2 : at `5 [k] `5 [k]

T5

125

D

'1 : at `6 [k] ^ t[k] = 0 `6 [k]

'0: N7 > 0

Fig. 2.22. P-RANK diagram for Lemma C.

boxes. The box represents the response property, guaranteeing that eventually the computation will exit to one of the successors of this box.

From Communal to Individual Accessibility Program MUX-AST for mutual exclusion by add-and-store instructions does not fully satisfy our expectations from a satisfactory solution to the mutual exclusion problem. It falls short in guaranteeing communal accessibility rather than individual accessibility. However, once some process is admitted to the critical section we can appoint it as an arbitrator for the next round. This is because when being in the critical section it can perform activities such as determining which process will be the next to be admitted, without having to worry about possible interference from other processes. In Fig. 2.25 we present program IMUX-AST, which implements individual accessibility. This program extends program MUX-AST in several ways. It contains an additional variable next ranging over 1::M, and whose value represents the index of a process, that has been given higher priority in the last arbitration round. The local variable t of MUX-AST is transformed in IMUX-AST into an array t[1::M] that can be inspected by each of the processes. Initially next = 0. The protocol proceeds very much as before, except that at `4 we introduced a new gate. The function of the gate at `4 is to hold there all processes except the one that has been given higher priority. Note that, if no process has been given priority, next = 0 and all processes can pass the gate at `4 . From there on, the protocol proceeds as before, except that there is an additional code performing an arbitration round at `9::15. Since this code follows immediately after the critical section it is guaranteed to be performed in exclusion, by a single process P[i]. The rst question asked at `9 is whether a new round of arbitration is needed.

126


F


F

E F F E E - E

k 2 [1::M]:

N4 = 0

'9 : at `2 [k] `2 [k]

'8 : at `3 [k] ^ t[k] < 0 `3 [k]

N4 > 0

y 0; N5::8 > 0 : (4; L5::8)

'7 : at `5 [k] `5 [k]

`6 [k] ' : at ` [k] 6 6 `6 [k] '5 : at `7 [k] `7 [k] '4 : at `8 [k] `8 [k] `8 [k] '3 : at `4 [k] ^ y = 1 `4 [k]

T5

'1 : at `6 [k] ^ t[k] = 0 `6 [k] '0: N7 > 0

Fig. 2.23. P-RANK diagram for N2 > 0 )

1

C

T3

D ? C C D

T5

'2 : at `5 [k] ^ y = 1 `5 [k]

C

D

(N7 > 0).

D



^

127

N2 > 0

Lemma A

Lemma A

N4 > 0; y 0

Lemma B

N4 > 0

y=1

Lemma C

N7 > 0

Fig. 2.24. Top-level structure of the proof.

A new round is needed if either no process has been assigned a high priority, i.e., next = 0, or if the process with the higher priority is P[i] itself. The other case is that some other process, P[k], for k 6= i has been assigned a high priority, but P[i] entered the critical section ahead of P[k]. The algorithm is such that some overtaking is possible. In this case, P[k] is still attempting entry to its critical section and we should not modify its priority. Hence in such a case, P[i] proceeds directly to `16 and no arbitration takes place. On entering the arbitration section, variable next is reset to 0 for the case that its previous value was i. Process P[i] then sets variable j to the next index following i in cyclic order, and enters the while loop at `12 . The loop searches

128



in M : integer where M = 0 local j; y; next : integer where y = 1; next = 0 t : array [1::M] of integer where t = 0

3 2` : loop forever do 377 66 2` : noncritical 66 6` : t[i] := 1 77777 66 66 7777 66 66`2: while t[i] < 0 do 377777 66 66 ` : await next = 0 _ next = i 77777 66 66 66` : await y > 0 7 7 66 66 66` : t[i] := y := y 1 777777 66 66 66` : if t[i] = 0 then 777777 66 66 66 2 777777 3 6 6 ` : critical 777777 P[i] :: 66 66 66 6 7 66 66 666 66`2: if next = 0 _ next = i then 377777777777 77777777 66 66 66 66 ` : next := 0 7 6 6 6 77777777 66 6 66 6 6` : j := (i mod M) + 1 7 7 6 6 6 66 6 66 6 6` : while next = 0 ^ j 6= i do777777777 66 66 66 66 66 2 3 7777777777777 6 6 6 66 6 66 6 6 6` : if t[j] < 0 then 7 7777777 66 66 66 64 64 4 ` : next := j 5 75757777777 6 66 6 64 75777 ` : j := (j mod M) + 1 55 44 0

1

2

3

4

5 6

7

M i=1

8

9

10

11

12

13

14

15

`16 : y := y + 1

Fig. 2.25. Program IMUX-AST | guaranteeing individual accessibility.

for the rst j in cyclic order such that t[j] < 0. Note that t[j] < 0 is a reliable indicator that P[j] is interested in entering the critical section but has not done so yet. If such a j is found, P[i] sets next to j, thus declaring j to have a high priority, and then exits the loop. Another possibility is that no such j has been found, and then j will close a full cycle and return to the value i. The loop terminates in both of these cases. The reader is invited to verify that this program guarantees individual accessibility, i.e., that it satis es the requirement at `2 [k] )

1

at `7 [k].



129

Readers-Writers with Add-And-Store Instructions An interesting extension of the mutual exclusion problem is the readers-writers problem. In this problem we distinguish two types of critical sections, called a reading section and a writing section . The required exclusion property is that while some process resides in a writing section, no other process may reside in either a reading or a writing section. Note that this allows several processes to cohabit a reading section.

The Program

Program READ-WRITE for solving the readers-writers problem, using add-and-store instructions, is presented in Fig. 2.26. (Compare with program READ-WRITE of Fig. 2.11 of the SAFETY book, which uses generalized semaphores.) After the statement noncritical at `1 , which represents the noncritical activity of the processes, each process branches nondeterministically to either the read protocol R, at location `2::7, or to the write protocol W, at `8::14. In the read protocol, each reader tries to decrement y and achieve a nonnegative value in t (and in y). Since the initial value of y is M, up to M readers may decrement y by 1, and still obtain a nonnegative value. If a reader succeeds to obtain a nonnegative value for t, it proceeds to the read section at `6 . If it does not, it corrects y at `7 and continues to loop. The writer's protocol is similar, except that a writer subtracts M From y, attempting to obtain a nonnegative value. This is possible only if that particular writer is the only one currently subtracting from y. Even if one reader has subtracted and lowered y to M 1, the writer, subtracting a further M will already obtain 1, and be barred from entering the writing section. Another special feature of the write protocol is the wait at `10 for y to become M. This is similar to the await y > 0 we had in the mutual exclusion program MUX-AST (Fig. 2.25). This is necessary, because otherwise we can construct a computation in which two writers chase one another around the `9 loop, keeping y always negative, without any of them or a reader being able to enter any of the critical sections. With the await gate at `10 , this cannot happen as we will prove below.

Proving Mutual Exclusion

The rst property we prove is that of exclusion, as required by the problem. This is established by several invariants. Invariant I1 N5::7 + M N12::14 + y = M. This equality holds initially, since y = M and N5::7 = N12::14 = 0. It is

130



in M: integer where M > 0 local y : integer where y = M

3 2 local t: integer where t = 0 77 66` : loop forever do 77 66 2 3 7 66 62` : noncritical 3 377777 2` : t := 1 66 66 7777777 66 6666 6` : while t < 0 do 7 7 6 66 6666 6 2 37 777 66 6666R :: 66 6` : t := y := y 1777 777777777 66 6666 66 66` : if t 0 then 7777 777777 66 6666 64 4 ` : Read 575 777777 777777 ` : y := y + 1 P[i] :: 666 66666 777777 6 66 6666 or 377777777 2` : t := 1 66 6666 7777777 66 6666 7 6 ` : while t < 0 do 7777 66 2 66 6666 66 ` : await y = M 3777777777 66 6666 66 6666W :: 66 666` : t := y := y M 77777777777777 66 6` : if t 0 then 777777 66 6666 64 64 ` : Write 7575777777 66 6464 5575 4 ` : y := y + M 0

1

2

3

4

5

M i=1

6

7

8

9

10

11

12

13

14

Fig. 2.26. Program READ-WRITE (readers-writers with add-and-store).

preserved by transitions, such as `4 which increments N5::7 by 1 and decrements y by 1, or `11 which increments N12::14 by 1 and decrements y by M. Similarly, it is preserved by `7 and `14 . Invariant I2 t0 N5t::70 + M N12 ::14 M. There are two transitions that may endanger the invariance of this assertion. t0 `4 [i] while N5t::70 + M N12 ::14 = M However, due to I1 , y = M N5::7 M N12::14



M

N5t::70

131

t0 M N12 ::14 = 0:

So the execution of `4 [i] will produce t0 [i] < 0, and hence N5t::70 does not increase. t0 `11 [i] while N5t::70 + M N12 ::14 > 0 t0 This is a dangerous situation since by adding one more element to N12 ::14 the sum will increase beyond M. However due to I1 , and a calculation identical to the one before we obtain t0 y M N5t::70 M N12 ::14 < M. Consequently, the execution of `11[i] produces t0[i] < 0, and does not increase t0 N12 ::14. Invariant I3 0 L6 Lt 5::7 : This is equivalent to the implication at `6 [i] ! t[i] 0, claimed for every i = 1; : : :; M. The invariant can be veri ed by considering the transitions that enter `6 . Since a process P[i] can enter `6 only if t[i] 0, 0 it follows that i 2 Lt 5::7 , after the transition. Invariant I4 Similarly to the above invariant, we can also prove 0 L13 Lt 12::14 , which is equivalent to at `13 [i] ! t[i] 0. From I3 and I4 we can conclude t0 N6 + M N13 N5t::70 + M N12 ::14: Using I2 we conclude N6 + M N13 M. From this it is easy to infer N13 > 0 ! N6 = 0 ^ N13 = 1, which is precisely the exclusion property required. It states that if some process is at `13 , then it is the only one there, and no process is at `6 .

Proving Accessibility

132



The response property we prove for this program is again that of communal accessibility . Since this program has two types of critical sections, a read and a write

section, communal accessibility has an even broader interpretation. It states that if some process is interested in entering one of the critical sections, then some process will eventually enter one of the critical sections. We cannot even guarantee, for example, that if some process wants to read (write) then some process will eventually read (write). This property is expressible by N2 + N8 > 0 ) (N6 + N13 > 0). We prove this property by two lemmas, concentrating rst on the writers .

Lemma A

N8 > 0

1 ) 1

(N6 + N13 > 0)

This lemma states that if a process is interested in writing, then eventually some process will either read (visit `6 ) or write (visit `13 ). The proof of the lemma is established by a sequence of simpler lemmas, identifying important intermediate stages in getting from N8 > 0 to N6 +N13 > 0. We refer the reader to Fig. 2.27 which presents a diagram showing the structure of the proof.

Lemma A1

N8 > 0 )

1

(N10 > 0)

This lemma ensures that if some process is currently at `8 then eventually some process will arrive at `10. This simple property is a direct consequence of the property at `8 [i] ) at `10[i], which is established by the RANK diagram of Fig. 2.28.

1

'2 : at `8 [i] `8 [i]

'1 : at `9 [i] ^ t[i] < 0 `9 [i]

'0 : at `10[i]

Fig. 2.28. P-RANK diagram for Lemma A1.

Arriving at a state satisfying N10 > 0, there are two cases to be considered. The easier one is that y = M, and Lemma A4 below shows how to get from this situation to the goal N6 + N13 > 0. The more complicated situation is when y < M (in view of the invariant I1, always y M). The two lemmas, A2 and A3, show that being at N10 > 0 ^ y < M we eventually get to the easier case of N10 > 0 ^ y = M. They split the case N10 > 0 ^ y < M into two subcases, according to whether N11::14 is positive or zero, and show that from both we eventually arrive to N10 > 0 ^ y = M.



N10 > 0

y<M

? N8 > 0 A1

? - ? A2

133

N11::14 > 0

A2 N11::14 = 0

A3

A3

y=M A4

?

N6 + N13 > 0

Fig. 2.27. Structure of the proof of Lemma A.

Lemma A2

1

N10 > 0 ^ y < M ^ N11::14 > 0 ) N10 > 0 ^ (N11::14 = 0 _ y = M)

The proof of this lemma can be based on rule WELL-JP, and is presented in the P-RANK diagram of Fig. 2.29. Note that transitions from `14 may either retain N11::14 > 0 and y < M, or evacuate L11::14 completely, or increase y to become M. It is possible for y to equal M, while some processes are still at `10;11. Note that we have to consider also the possibility that a transition `7 increases y to become M.

134


F


C

k 2 [1::M]: N10 > 0; y < M : L11::14

'4 : at `11[k] `11

`12 ' : at ` [k] 3 12 `12 '2 : at `13[k] `13

E ?

'1 : at `14[k] `14 `14

T14

'0: N10 > 0

N11::14 = 0

T7

?

y=M

D

Fig. 2.29. P-RANK diagram for Lemma A2.

In the proof we rely on the fact that while y < M, all transitions of the form `10 [i] are disabled.

Lemma A3

1

N10 > 0 ^ y < M ^ N11::14 = 0 ) (N10 > 0 ^ y = M) _ N6 > 0

The proof of the lemma is presented in the P-RANK diagram of Fig. 2.30. We observe that, due to I1 , the antecedent implies that 0 < N4::7 < M and



F

k 2 [1::M]: N10 > 0; N11::14 = N6 = 0; 0 < y < M

F

?

N4 = 0 t 0 is covered by '1 N6 > 0 is the goal '0 . The sum N5t 0 ^ y < M ) (N10 > 0 ^ y = M) _ N6 > 0 : It remains to show that from (N10 > 0) ^ (y = M) we are also guaranteed to reach N13 + N6 > 0. This is claimed by the next lemma.

1

Lemma A4

N10 > 0 ^ y = M )

1

(N6 + N13 > 0)

The proof of this lemma is presented in the P-RANK diagram of Fig. 2.31.

F F

k 2 [1::M]: y=M

'4 : at `10[k] `10 [k]

`11 [k]

E

E ^ ?

T11

'1 : at `12 [k] t[k] 0 `12[k]

'0 :

N13 > 0

'3 : at `11[k]

C C

T4

D

?

D

'2 : at `5 [k] ^ t[k] 0 `5 [k]

N6 > 0

Fig. 2.31. P-RANK diagram for Lemma A4. This concludes the proof of Lemma A, which states that if a process wishes to write then eventually some process will read or some process will write. By combining Lemmas A1, A2, and A3, we can also obtain Corollary A



Corollary A

1

N10 > 0 )

137

(N6 + N13 > 0)

The second case we have to handle is the possibility that a process wishes to read. This is covered by

Lemma B

1

N2 > 0 )

(N6 + N13 > 0)

The proof of Lemma B is also split into several intermediate stages. In Fig. 2.32 we present these stages and the lemmas that lead from one stage to the next.

? ? ? ?

N2 > 0 B1

N3t 0

B2

N12::14 > 0 B2

B3

N12::14 = 0

N5t0 > 0 B5

?

? ? B2 B3

N12 > 0 B4

?

B4

N6 > 0

N13 > 0

Fig. 2.32. Structure of the proof of Lemma B.

Lemma B1

N2 > 0 )

1

N3t 0

This simple lemma follows a process that wishes to read, from location `2 to location `3 , where it arrives with t[i] < 0. The lemma is so simple that we skip its proof.

138



Arriving at `3 , it is important to distinguish between the case that y > 0 and the case y 0. Due to the invariant I1 , if y 0 then either N12::14 > 0 or N5::7 = M. Since N3 > 0, it is impossible for all processes to be at `5::7, and therefore we conclude that N12::14 > 0. The next lemma shows that this case must develop to the simpler case in which N12::14 = 0. However, we cannot hope that while this happens, the process which is currently at `3 will stand still. What can it do? It can loop around `3::7 and perhaps even get to `5 with a nonnegative t[i]. If this happens then we are close to our goal N6 > 0. If it does not happen, we should at least make sure that this process does not escape the loop `3::7 without visiting `6 rst. To contain some processes in the loop we use the set t 0 )

1

2 t 0 ^ N 3 7

:: = 0

12 14

N5 > 0 _ N12 > 0

_3 5

The proof of this lemma is presented in the P-RANK diagram of Fig. 2.33. It uses the ranking function N12::14 which decreases on each `14 transition. By I1, as long as N12::14 > 0, y is smaller than M. In a more general situation we would have to worry about the possibility of N12::14 increasing due to an `11 transition. Here, however, any `11 transition makes L12 nonempty, which is one of the goals of this lemma. Similarly, the only transition that can violate N3t 0 is L4 from a positive 0 y. This, however, makes Lt nonempty, which is another goal. 5 The next lemma considers a situation in which there is still some unsatis ed process (i.e., t[i] < 0) in the `3::7 loop, while N12::14 = 0. It shows that eventually 0 one of the sets Lt or L12 must become nonempty. 5

Lemma B3

N3t 0 ^ N12::14 = 0 )

1

N5t0 > 0 _ N12 > 0

The lemma is proved 0in P-RANK diagram of Fig. 2.34. Note that while being t 0 implies that we must have a nonempty L3::5;7. If L4 is nonempty, then due to N12::14 = 0 and to I1, we are guaranteed to have a positive y. Therefore, any `4 transition t0 from such a state, leads to a nonempty L5 .

Lemma B4

N12 > 0 )

1

(N6 + N13 > 0)


Problems

F

k 2 [1::M]: N12::14 > 0; N3t 0; y < M : L12::14 `12 [k] ' : at ` [k] 3

C

139

12

`12 [k]

'2 : at `13 [k] `13 [k]

E T4

'0 :

t0

N5 > 0

?

'1 : at `14 [k] `14 [k] `14 [k]

t 0 N12::14 = 0

N12 > 0

Fig. 2.33. P-RANK diagram for Lemma B2.

This lemma starts from a situation in which we identify a writer at `12 . If t[i] 0 for this process, then we can easily prove that eventually N13 > 0. Otherwise, t[i] < 0, and we can easily trace the progress of this process from `12 , through `14, `9 until it reaches `10. We now use Lemma A to show that if L10 is nonempty, then eventually some process will reach `6 or `13 .

Lemma B5

N5t0 > 0 )

1

(N6 > 0)

This lemma requires one helpful step, performed by any of the processes in L5 , to achieve a nonempty L6 . t0

Problems Problem 2.1 (mutual exclusion by turn setting)

page 105

140



F

C

D E ? ?

k 2 [1::M]: N3t 0; N12::14 = 0; t[k] < 0 '4 : at `5 [k] `5 [k] '3 : at `7 [k] `7 [k] '2 : at `3 [k] `3 [k]

`4 [k] ' : at ` [k] ^ y > 0 1 4

'0 :

T4

T11

N5t0 > 0

N12 > 0

Fig. 2.34. P-RANK diagram for Lemma B3.

1

Show that the property of (individual) accessibility, speci ed by at `2 [i] ^ t = 0 ) at `5 [i] is not guaranteed for program TURN (Fig. 2.8).

Problem 2.2 (mutual exclusion with central manager)

page 105 Program PMUX-MAN of Fig. 2.35 implements mutual exclusion, using a central allocator process A which receives requests in variable y and responds in variable x. Using the parameterized rules presented in this chapter, prove accessibility for this program, which can be speci ed by the response formula N2 > 0 ) (N4 > 0),

1


Problems

141

where N2 counts the number of processes P[j] currently executing at location m2 , while N4 counts the number of processes P[j] currently executing at location m4

local x; y: integer where x = 0; y = 0

2` : loop forever do 3 66 2` : while y = 0 do377 66 6 ` : skip 77777 6 6 7777 A :: 66 66` : x := y 6 66 6` : while x 6= 0 do7777 7575 64 64 ` : skip 0

1

2

3

4

5

`6 : y := 0

2m : loop forever do 3 66 2m : noncritical 377 66 6m : while x 6= j do777 7777 P[j] :: 66 66 m : y := j 7777 66 66 55 4 4m : critical 0

M j =1

1

2

3

4

m5 : x := 0

Fig. 2.35. Program PMUX-MAN. Note that this program cannot guarantee individual accessibility but only communal accessibility (see page 104). Problem 2.3 (molecular bakery algorithms) page 117 In Fig. 2.17, we presented the atomic version of the bakery algorithm and veri ed its properties. This atomic version is obviously not an LCR-program and represents a very simpli ed version which cannot be directly implemented on existing hardware. A rst attempt to transform program BAKERY-AT into an LCR program breaks each of the non-LCR statements `2 and `3 into a for -loop. This leads to program BAKERY-1, presented in Fig. 2.36. While program BAKERY-1 obeys the LCR restriction, it is no longer a correct solution to the mutual exclusion problem.

142



in M : integer where M > 1 ticket : array [1::M] of integer where ticket = 0

2j; k; t: integer where j = k = t = 0 3 66` : loop forever do 77 66 2 3777 66 ` : noncritical 7777 66 66` : t := 0 7777 6 66 6` : for k = 1 to M do 7777 6 66 6 ` : t := max t; ticket [k] 7777 6 66 6 M ` : ticket [i] := t + 1 7777 6 P[i] :: 66 6 7777 6 i 66 6` :2for j = 1 to0M do 3 1 7777 6 66 6 j=i 6 66 6 64` : await B@ _ ticket [j] = 0 CA75777777 6 66 6 7 _ ticket [i] < ticket [j] 77777 66 66 7577 64 64` : critical 5 0

1

2

3

4

5

=1

6

7

8

`9 : ticket [i] := 0

Fig. 2.36. Program BAKERY-1: an LCR version.

(a) Present a segment of a computation of program BAKERY-1 which violates mutual exclusion. As can be seen from your counter-example, the fault can be traced to the fact that while process P[i] is computing its next ticket value at locations `3 {`5 , the value of ticket [i] is unreliable and should not be checked by other processes at statement `7 . To correct this problem, we introduce a protection mechanism, by which ticket [i] cannot be accessed while P[i] is at the location range `3 {`5. This leads to program BAKERY-2 of Fig. 2.37. The protection mechanism implemented in BAKERY-2, indeed solves the problem of mutual-exclusion violation. (b) Prove that program BAKERY-2 ensures mutual exclusion. While program BAKERY-2 guarantees mutual exclusion, it fails to maintain the complementary required property of accessibility. (c) Show a computation of program BAKERY-2 which fails to satisfy the property


Problems

in M

143

: integer where M > 1

choosing : array [1::M] of boolean where choosing = F ticket : array [1::M] of integer where ticket = 0

3 2 j; k; t: integer where j = k = t = 0 77 66` : loop forever do 77 66 2 3 7 66 ` : noncritical 7777 66 66` : choosing [i] := T 7777 66 66` : t := 0 7777 66 66` : for k = 1 to M do 7777 66 66 7777 66 66 ` : t := max t; ticket [k] 7777 M 66 66` : ticket [i] := t + 1 P[i] :: 6 66` : choosing [i] := F 7777 66 6 i 7777 66 66` :2for j = 1 to M do 3777777 66 66 ` : await :0choosing [j] 177777 66 66 66 j = i 777777 66 66 64` : await B@ _ ticket [j] = 0 C A57777 66 66 _ ticket [i] < ticket [j] 7777 66 66 7577 64 64` : critical 5 0

1 2

3

4

5

6

=1

7

8

9

10

11

`12 : ticket [i] := 0

Fig. 2.37. Program BAKERY-2: ticket computation is protected.

of accessibility for one of the processes. To overcome the diculty illustrated by your counter-example, we augment the priority comparison mechanism of statement `7 by a secondary component, which is the process index. Thus, if both ticket [i] and ticket [j] are dierent from zero, then P[i] has a higher priority if ticket [i]; i ticket [j]; j ; where the comparison is lexicographic. This leads to program BAKERY of Fig. 2.38. This version is anlly satisfactory in that it satis es the properties of mutual exclusion and accessibility. (d) Prove that program BAKERY satis es the property of mutual exclusion.

144



in M

: integer where M > 1

choosing : array [1::M] of boolean where choosing = F ticket : array [1::M] of integer where ticket = 0

3 2 j; k; t: integer where j = k = t = 0 77 66` : loop forever do 66 2 3777 66 ` : noncritical 7777 66 66` : choosing [i] := T 7777 6 66 6` : t := 0 7777 6 66 6` : for k = 1 to M do 7777 6 66 6 7777 6 ` : t := max t; ticket [k] 66 6 7777 6 M 6 ` : ticket [i] := t + 1 P[i] :: 66 666` : choosing [i] := F 7777 6 i 7777 66 66` : for j = 1 to M do 7777 66 66 2` : await :choosing [j] 3 7777 66 66 6 1 0 777777 j=i 66 66 66 CA757777 66 66 4` : await B@ _ ticket [j] = 0 7777 66 66 _ ticket [i] ticket [j] 7777 66 66 575 4 4` : critical 0

1

2

3

4

5

6

=1

7 8

9

10

11

`12 : ticket [i] := 0

Fig. 2.38. Program BAKERY: Final version.

(e) Prove that program BAKERY satis es the property of accessibility.

Problem 2.4 (Peterson's algorithm for n processes)

page 117 Program MUX-PET-N of Fig. 2.39 presents a solution to the mutual-exclusion problem for an arbitrary number of processes. The while statement at `3 gradually increases the priority of process P[i] from 1 to n. When the priority, expressed by j (j[i] for process P[i]), grows beyond n, P[i] is admitted to its critical section. On entering priority level j, process P[i] records (at `4 ) its current priority in y[i] and writes its identity number (i) in s[j] the signature logbook for this level. It then remains at level j until it detects one of two occurrences. Either the number of processes of priority not smaller than j becomes 1, which means that P[i] is the only one with such priority, or the logbook s[j] assumes a value dierent than i, implying that some of the processes


Problems

145

in n : integer where n 2 local y; s: array[1::n] of integer where y = s = 0

2local j; k; above-me : integer 3 66` : loop forever do 7 3777 66 2` : noncritical 66 6` : j := 1 77777 66 66 7777 66 66` :2while j < n do 37777 66 66 ` : y[i] := j 77777777 66 66 66` : s[j] := i 777777 66 66 66` : above-me := n 777777 66 66 66 66 66 66` :2while above-me > 1 ^ s[j] = i do 3777777777 P[i] :: 6 6 6 ` : above-me := 0 777777 66 66 66 6 7 ` : k := 1 6 6 66 6 6 66 77777777 6 ` : while k n do 6 66 6 6 66 2 77777777 3 6 6 66 6 6 66 ` : if y[k] j then 77777777 6 6 66 6 6 64 64 [` : above-me := above-me + 1]7575777777 777777 66 66 66 ` : k := k + 1 6 57777 66 6 4 6 7777 66 6 ` : j := j + 1 7575 64 64` : critical 0

1 2

3

4

5 6

n

7

i=1

8

9

10

11

12

13

14

15

`16 : y[i] := 0

Fig. 2.39. Program MUX-PET-N (mutual exclusion for n processes).

entered level j after P[i]. To check for the rst occurrence, statements `8 to `13 repeatedly count the number of processes with priority not smaller than j. Note that one cannot assume that on termination of the while statement `10 the value of above-me necessarily equals the number of processes with priority not smaller than j. While P[i] counts, some processes with high priority may go through the critical section and lower their priority, and some processes with low priority may raise their priority to the tested level after being considered. Prove that program MUX-PET-N guarantees accessibility to each of its processes, by showing that the response formula at `2 [i] ) at `15[i]

1

146


is P-valid over MUX-PET-N.


Temporal verification of reactive systems: progress

Reactive systems: modelling, specification and verification

Reactive Systems: Modelling, Specification and Verification

Reactive Systems: Modelling, Specification and Verification

The Temporal Logic of Reactive and Concurrent Systems: Specification

Reactive Extrusion Systems

Temporal Information Systems in Medicine

Programming reactive systems in Haskell

Computer-aided modeling of reactive systems

Temporal Information Systems in Medicine

Reactive flow modeling of hydrothermal systems

Specification and Verification of Multi-agent Systems

Biometric Technologies and Verification Systems

Modeling and Verification of Real-time Systems

reactive power control in electric systems

Statistical Methods for Spatio-Temporal Systems

Reactive Oxygen Species in Biological Systems

Formal Development of Reactive Systems: Case Study Production Cell

Real-time systems. Scheduling, analysis and verification

Safety Instrumented Systems Verification: Practical Probabilistic Calculation

Model-Based Testing of Reactive Systems, Advanced Lectures 2004

Model-Based Testing of Reactive Systems: Advanced Lectures

Embedded Systems Handbook,: Embedded Systems Design and Verification

Real-Time Systems: Scheduling, Analysis, and Verification

Embedded Systems Handbook,: Embedded Systems Design and Verification

Lords Temporal

Principles of Functional Verification

Manual of Temporal Bone Dissection

Lords Temporal

Reactive Distillation

Reviews of reactive intermediate chemistry

Temporal verification of reactive systems: progress

Reactive systems: modelling, specification and verification

Reactive Systems: Modelling, Specification and Verification

Reactive Systems: Modelling, Specification and Verification

The Temporal Logic of Reactive and Concurrent Systems: Specification

Reactive Extrusion Systems

Temporal Information Systems in Medicine

Programming reactive systems in Haskell

Computer-aided modeling of reactive systems

Temporal Information Systems in Medicine

Reactive flow modeling of hydrothermal systems

Specification and Verification of Multi-agent Systems

Biometric Technologies and Verification Systems

Modeling and Verification of Real-time Systems

reactive power control in electric systems

Statistical Methods for Spatio-Temporal Systems

Reactive Oxygen Species in Biological Systems

Formal Development of Reactive Systems: Case Study Production Cell

Real-time systems. Scheduling, analysis and verification

Safety Instrumented Systems Verification: Practical Probabilistic Calculation

Model-Based Testing of Reactive Systems, Advanced Lectures 2004

Model-Based Testing of Reactive Systems: Advanced Lectures

Embedded Systems Handbook,: Embedded Systems Design and Verification

Real-Time Systems: Scheduling, Analysis, and Verification

Embedded Systems Handbook,: Embedded Systems Design and Verification

Lords Temporal

Principles of Functional Verification

Manual of Temporal Bone Dissection

Lords Temporal

Reactive Distillation

Reviews of reactive intermediate chemistry

Recommend Documents